Skip to content

Commit 6c5aa91

Browse files
nasbenchnasbench
committed
more updates
1 parent feb9ec4 commit 6c5aa91

File tree

6 files changed

+33
-64
lines changed

6 files changed

+33
-64
lines changed

‎detections/cloud/circle_ci_disable_security_step.yml‎

Lines changed: 11 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Circle CI Disable Security Step
22
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
3-
version: 6
4-
date: '2025-06-10'
3+
version: 5
4+
date: '2025-05-02'
55
author: Patrick Bareiss, Splunk
6-
status: production
6+
status: experimental
77
type: Anomaly
88
description: The following analytic detects the disablement of security steps in a
99
CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and
@@ -15,40 +15,17 @@ description: The following analytic detects the disablement of security steps in
1515
with the disablement, and examine any relevant artifacts and concurrent processes.
1616
data_source:
1717
- CircleCI
18-
search: '`circleci`
19-
| rename workflows.job_id AS job_id
20-
| join job_id [
21-
| search `circleci`
22-
| stats values(name) as step_names count by job_id job_name
23-
]
24-
| stats count by
25-
step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{}
26-
| rename vcs.* as * , owners{} as user
27-
| lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step
28-
| search mandatory_step=*
29-
| eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0)
30-
| where mandatory_step_executed=0 | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
31-
| eval phase="build"
32-
| `security_content_ctime(firstTime)`
33-
| `security_content_ctime(lastTime)`
34-
| `circle_ci_disable_security_step_filter`'
18+
search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci`
19+
| stats values(name) as step_names count by job_id job_name ] | stats count by step_names
20+
job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
21+
* , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name
22+
AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names,
23+
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url
24+
"(?<repository>[^\/]*\/[^\/]*)$" | eval phase="build" | `security_content_ctime(firstTime)`
25+
| `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
3526
how_to_implement: You must index CircleCI logs.
3627
known_false_positives: unknown
3728
references: []
38-
drilldown_searches:
39-
- name: View the detection results for - "$dest$"
40-
search: '%original_detection_search% | search dest = "$dest$"'
41-
earliest_offset: $info_min_time$
42-
latest_offset: $info_max_time$
43-
- name: View risk events for the last 7 days for - "$dest$"
44-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
45-
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
46-
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
47-
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
48-
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
49-
| `security_content_ctime(lastTime)`'
50-
earliest_offset: $info_min_time$
51-
latest_offset: $info_max_time$
5229
rba:
5330
message: Disable security step $mandatory_step$ in job $job_name$ from user $user$
5431
risk_objects:

‎detections/cloud/gsuite_drive_share_in_external_email.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,12 +57,12 @@ drilldown_searches:
5757
earliest_offset: $info_min_time$
5858
latest_offset: $info_max_time$
5959
rba:
60-
message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
60+
message: Suspicious share gdrive from $owner$ to $email$ namely as $doc_title$
6161
risk_objects:
6262
- field: email
6363
type: user
6464
score: 72
65-
- field: parameters.owner
65+
- field: owner
6666
type: user
6767
score: 72
6868
threat_objects: []

‎detections/endpoint/windows_ad_suspicious_gpo_modification.yml‎ renamed to ‎detections/deprecated/windows_ad_suspicious_gpo_modification.yml‎

Lines changed: 8 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
name: Windows AD Suspicious GPO Modification
22
id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf
33
version: 7
4-
date: '2025-06-10'
4+
date: '2025-06-16'
55
author: Dean Luxton
6-
status: production
6+
status: deprecated
77
type: TTP
88
data_source:
99
- Windows Event Log Security 5136
1010
- Windows Event Log Security 5145
11-
description: |
12-
This analytic looks for a the creation of potentially harmful GPO which
11+
description: This analytic looks for a the creation of potentially harmful GPO which
1312
could lead to persistence or code execution on remote hosts. Note, this analyic
1413
is looking for the absence of the corresponding 5136 events which is evidence of
1514
the GPOs being manually edited (using a tool like PowerView) or potentially missing
@@ -27,7 +26,7 @@ search: "`wineventlog_security` EventCode=5145 ShareName=\"\\\\\\\\*\\\\SYSVOL\"
2726
$gpo_guid$\" \n | stats min(_time) as _time values(eval(if(OperationType==\"%%14675\"\
2827
,AttributeValue,null))) as old_value values(eval(if(OperationType==\"%%14674\",AttributeValue,null)))
2928
as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID
30-
src_user SubjectLogonId dest \n | rex field=old_value max_match=10000 \"(?P<old_values>\\\
29+
src_user SubjectLogonId \n | rex field=old_value max_match=10000 \"(?P<old_values>\\\
3130
{.*?\\})\" \n | rex field=new_value max_match=10000 \"(?P<new_values>\\{.*?\\})\"\
3231
\ \n | rex field=ObjectDN max_match=10000 \"CN=(?P<policy_guid>\\{.*?\\})\" \n\
3332
\ | mvexpand new_values \n | where NOT new_values IN (old_values,\"{00000000-0000-0000-0000-000000000000}\"\
@@ -41,34 +40,20 @@ search: "`wineventlog_security` EventCode=5145 ShareName=\"\\\\\\\\*\\\\SYSVOL\"
4140
values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID)
4241
as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid |
4342
mvexpand folder | where NOT folder IN (newPolicy) | `windows_ad_suspicious_gpo_modification_filter`"
44-
how_to_implement: |
45-
Ingest EventCodes 5145 and 5136 from domain controllers. Additional
43+
how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional
4644
SACLs required to capture EventCode 5136, see references for further information
4745
on how to configure this. The Group Policy - Audit Detailed File Share will need
4846
to be enabled on the DCs to generate event code 5145, this event is very noisy on
4947
DCs, consider tuning out sysvol events which do not match access mask 0x2.
50-
known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk.
48+
known_false_positives: When a GPO is manually edited and 5136 events are not logging
49+
to Splunk.
5150
references:
5251
- https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122
5352
- https://github.com/X-C3LL/GPOwned
5453
- https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/
5554
- https://wald0.com/?p=179
5655
- https://github.com/FSecureLABS/SharpGPOAbuse
5756
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
58-
drilldown_searches:
59-
- name: View the detection results for - "$dest$"
60-
search: '%original_detection_search% | search dest = "$dest$"'
61-
earliest_offset: $info_min_time$
62-
latest_offset: $info_max_time$
63-
- name: View risk events for the last 7 days for - "$dest$"
64-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
65-
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
66-
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
67-
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
68-
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
69-
| `security_content_ctime(lastTime)`'
70-
earliest_offset: $info_min_time$
71-
latest_offset: $info_max_time$
7257
rba:
7358
message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy
7459
$gpo_guid$
@@ -98,4 +83,4 @@ tests:
9883
- data:
9984
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log
10085
source: XmlWinEventLog:Security
101-
sourcetype: XmlWinEventLog
86+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_driver_inventory.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ tags:
3232
- Splunk Enterprise Security
3333
- Splunk Cloud
3434
security_domain: endpoint
35+
manual_test: Cannot be tested automatically, as it needs additional transforms and props to make the data ready.
3536
tests:
3637
- name: True Positive Test
3738
attack_data:

‎detections/network/detect_outbound_smb_traffic.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,15 @@ description: The following analytic detects outbound SMB (Server Message Block)
1616
data_source:
1717
- Zeek Conn
1818
- Cisco Secure Firewall Threat Defense Connection Event
19-
search: '
19+
search: |
2020
| tstats `security_content_summariesonly`
2121
earliest(_time) as start_time
2222
latest(_time) as end_time
2323
values(All_Traffic.action) as action
2424
values(All_Traffic.app) as app
2525
values(sourcetype) as sourcetype count
2626
from datamodel=Network_Traffic where
27-
All_Traffic.action=allowed AND
27+
All_Traffic.action IN ("allowed", "allow") AND
2828
(All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb")
2929
AND All_Traffic.src_ip IN (
3030
"10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"
@@ -39,9 +39,12 @@ search: '
3939
by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
4040
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
4141
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
42-
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.rule | `drop_dm_object_name("All_Traffic")` |
43-
`security_content_ctime(start_time)` | `security_content_ctime(end_time)` | iplocation
44-
dest_ip | `detect_outbound_smb_traffic_filter`'
42+
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
43+
| `drop_dm_object_name("All_Traffic")`
44+
| `security_content_ctime(start_time)`
45+
| `security_content_ctime(end_time)`
46+
| iplocation dest_ip
47+
| `detect_outbound_smb_traffic_filter`
4548
how_to_implement: This search requires you to be ingesting your network traffic
4649
and populating the Network_Traffic data model.
4750
known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic

‎removed/deprecation_mapping.YML‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
detections:
2+
- content: Windows AD Suspicious GPO Modification
3+
removed_in_version: 5.10.0
4+
reason: Detection deprecated due to lack of data and consistency. Research is being done to create potential replacement in a future release.
25
- content: Windows Remote Access Software Hunt
36
removed_in_version: 5.8.0
47
reason: Detection has been replaced by a new detection with a more specific name and logic

0 commit comments

Comments
 (0)