Skip to content

Commit f8cd6cf

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into headless_bee
2 parents 1d1d0db + 5e5d72a commit f8cd6cf

7 files changed

+383
-0
lines changed

‎data_sources/windows_event_log_security_4700.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Windows Event Log Security 4700
2+
id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde
3+
version: 1
4+
date: '2025-03-11'
5+
author: Steven Dick
6+
description: Data source object for Windows Event Log Security 4700
7+
source: XmlWinEventLog:Security
8+
sourcetype: xmlwineventlog
9+
separator: EventID
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- EventID
16+
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'

‎data_sources/windows_event_log_security_4702.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Windows Event Log Security 4702
2+
id: 167e378e-3675-4042-b611-d3bfb6d2abc7
3+
version: 1
4+
date: '2025-03-11'
5+
author: Steven Dick
6+
description: Data source object for Windows Event Log Security 4702
7+
source: XmlWinEventLog:Security
8+
sourcetype: xmlwineventlog
9+
separator: EventID
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- EventID
16+
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'

‎detections/cloud/o365_bec_email_hiding_rule_created.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: O365 BEC Email Hiding Rule Created
2+
id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
3+
version: 1
4+
date: '2025-02-14'
5+
author: '0xC0FFEEEE, Github Community'
6+
type: TTP
7+
status: production
8+
description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
9+
This may indicate that an attacker has gained access to the account.
10+
search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" |
11+
stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder)
12+
as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval
13+
entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval
14+
read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder,
15+
"^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score
16+
| where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`'
17+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
18+
Office 365 management activity events. You also need to have the Splunk TA URL
19+
Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
20+
known_false_positives: Short rule names may trigger false positives. Adjust
21+
the entropy and length thresholds as needed.
22+
references:
23+
- https://attack.mitre.org/techniques/T1564/008/
24+
drilldown_searches:
25+
- name: View the detection results for - "$user$"
26+
search: '%original_detection_search% | search dest = "$user$"'
27+
earliest_offset: $info_min_time$
28+
latest_offset: $info_max_time$
29+
- name: View risk events for the last 7 days for $user$
30+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
31+
earliest_offset: $info_min_time$
32+
latest_offset: $info_max_time$
33+
rba:
34+
message: Potential BEC mailbox rule was created by $user$
35+
risk_objects:
36+
- field: user
37+
type: user
38+
score: 25
39+
threat_objects:
40+
- field: Name
41+
type: signature
42+
tags:
43+
analytic_story:
44+
- Office 365 Account Takeover
45+
asset_type: O365 Tenant
46+
mitre_attack_id:
47+
- T1564.008
48+
product:
49+
- Splunk Enterprise
50+
- Splunk Enterprise Security
51+
- Splunk Cloud
52+
security_domain: audit
53+
tests:
54+
- name: True Positive Test
55+
attack_data:
56+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log
57+
sourcetype: o365:management:activity
58+
source: o365

‎detections/endpoint/windows_scheduled_task_with_suspicious_command.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Windows Scheduled Task with Suspicious Command
2+
id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3
3+
version: 1
4+
date: '2025-02-07'
5+
author: Steven Dick
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
9+
data_source:
10+
- Windows Event Log Security 4698
11+
- Windows Event Log Security 4700
12+
- Windows Event Log Security 4702
13+
search: |-
14+
`wineventlog_security` EventCode IN (4698,4700,4702)
15+
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
16+
| xmlkv TaskContent
17+
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode
18+
| lookup windows_suspicious_tasks task_command as Command
19+
| where tool == "shell command use" OR tool == "suspicious paths"
20+
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode
21+
| `security_content_ctime(firstTime)`
22+
| `security_content_ctime(lastTime)`
23+
| `windows_scheduled_task_with_suspicious_command_filter`
24+
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
25+
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection.
26+
references:
27+
- https://attack.mitre.org/techniques/T1053/005/
28+
- https://www.ic3.gov/CSA/2023/231213.pdf
29+
- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
30+
- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$" and "$user$"
33+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: Investigate schedule tasks on $dest$
41+
search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
rba:
45+
message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$]
46+
risk_objects:
47+
- field: dest
48+
type: system
49+
score: 70
50+
- field: user
51+
type: user
52+
score: 70
53+
threat_objects:
54+
- field: Command
55+
type: signature
56+
tags:
57+
analytic_story:
58+
- Scheduled Tasks
59+
- Windows Persistence Techniques
60+
- Ransomware
61+
- Ryuk Ransomware
62+
asset_type: Endpoint
63+
mitre_attack_id:
64+
- T1053.005
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
74+
source: XmlWinEventLog:Security
75+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_scheduled_task_with_suspicious_name.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Windows Scheduled Task with Suspicious Name
2+
id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e
3+
version: 1
4+
date: '2025-02-07'
5+
author: Steven Dick
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
9+
data_source:
10+
- Windows Event Log Security 4698
11+
- Windows Event Log Security 4700
12+
- Windows Event Log Security 4702
13+
search: |-
14+
`wineventlog_security` EventCode IN (4698,4700,4702)
15+
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
16+
| xmlkv TaskContent
17+
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode
18+
| lookup windows_suspicious_tasks task_name as TaskName
19+
| where isnotnull(tool_type)
20+
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer
21+
| `security_content_ctime(firstTime)`
22+
| `security_content_ctime(lastTime)`
23+
| `windows_scheduled_task_with_suspicious_name_filter`
24+
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
25+
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
26+
references:
27+
- https://attack.mitre.org/techniques/T1053/005/
28+
- https://www.ic3.gov/CSA/2023/231213.pdf
29+
- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
30+
- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$" and "$user$"
33+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: Investigate schedule tasks on $dest$
41+
search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
rba:
45+
message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator
46+
risk_objects:
47+
- field: dest
48+
type: system
49+
score: 70
50+
- field: user
51+
type: user
52+
score: 70
53+
threat_objects:
54+
- field: Command
55+
type: signature
56+
tags:
57+
analytic_story:
58+
- Scheduled Tasks
59+
- Windows Persistence Techniques
60+
- Ransomware
61+
- Ryuk Ransomware
62+
asset_type: Endpoint
63+
mitre_attack_id:
64+
- T1053.005
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log
74+
source: XmlWinEventLog:Security
75+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)