Skip to content

Commit 3155274

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3664 from splunk/lamehug
lamehug
2 parents cff359d + 8488f80 commit 3155274

15 files changed

+938
-112
lines changed

‎detections/endpoint/domain_account_discovery_with_dsquery.yml‎

Lines changed: 56 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
name: Domain Account Discovery with Dsquery
22
id: b1a8ce04-04c2-11ec-bea7-acde48001122
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-08-27'
55
author: Teoderick Contreras, Mauricio Velazco, Splunk
66
status: production
7-
type: Hunting
8-
description: The following analytic identifies the execution of `dsquery.exe` with
9-
command-line arguments used to discover domain users. It leverages data from Endpoint
10-
Detection and Response (EDR) agents, focusing on process names and command-line
11-
executions. This activity is significant as it indicates potential reconnaissance
12-
efforts by adversaries to map out domain users, which is a common precursor to further
13-
attacks. If confirmed malicious, this behavior could allow attackers to gain insights
14-
into user accounts, facilitating subsequent actions like privilege escalation or
15-
lateral movement within the network.
7+
type: Anomaly
8+
description: The following analytic identifies the execution of `dsquery.exe`
9+
with command-line arguments used to discover domain users. It leverages data
10+
from Endpoint Detection and Response (EDR) agents, focusing on process names
11+
and command-line executions. This activity is significant as it indicates
12+
potential reconnaissance efforts by adversaries to map out domain users, which
13+
is a common precursor to further attacks. If confirmed malicious, this
14+
behavior could allow attackers to gain insights into user accounts,
15+
facilitating subsequent actions like privilege escalation or lateral movement
16+
within the network.
1617
data_source:
1718
- Sysmon EventID 1
1819
- Windows Event Log Security 4688
@@ -26,22 +27,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2627
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
2728
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
2829
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`'
29-
how_to_implement: The detection is based on data that originates from Endpoint Detection
30-
and Response (EDR) agents. These agents are designed to provide security-related
31-
telemetry from the endpoints where the agent is installed. To implement this search,
32-
you must ingest logs that contain the process GUID, process name, and parent process.
33-
Additionally, you must ingest complete command-line executions. These logs must
34-
be processed using the appropriate Splunk Technology Add-ons that are specific to
35-
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
36-
data model. Use the Splunk Common Information Model (CIM) to normalize the field
37-
names and speed up the data modeling process.
38-
known_false_positives: Administrators or power users may use this command for troubleshooting.
30+
how_to_implement: The detection is based on data that originates from Endpoint
31+
Detection and Response (EDR) agents. These agents are designed to provide
32+
security-related telemetry from the endpoints where the agent is installed. To
33+
implement this search, you must ingest logs that contain the process GUID,
34+
process name, and parent process. Additionally, you must ingest complete
35+
command-line executions. These logs must be processed using the appropriate
36+
Splunk Technology Add-ons that are specific to the EDR product. The logs must
37+
also be mapped to the `Processes` node of the `Endpoint` data model. Use the
38+
Splunk Common Information Model (CIM) to normalize the field names and speed
39+
up the data modeling process.
40+
known_false_positives: Administrators or power users may use this command for
41+
troubleshooting.
3942
references:
4043
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
4144
- https://attack.mitre.org/techniques/T1087/002/
45+
drilldown_searches:
46+
- name: View the detection results for - "$user$" and "$dest$"
47+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
48+
earliest_offset: $info_min_time$
49+
latest_offset: $info_max_time$
50+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
51+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
52+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
53+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
54+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
55+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
56+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
57+
earliest_offset: $info_min_time$
58+
latest_offset: $info_max_time$
59+
rba:
60+
message: An instance of $parent_process_name$ spawning $process_name$ was identified
61+
on endpoint $dest$ by user $user$.
62+
risk_objects:
63+
- field: user
64+
type: user
65+
score: 3
66+
- field: dest
67+
type: system
68+
score: 3
69+
threat_objects:
70+
- field: parent_process_name
71+
type: parent_process_name
72+
- field: process_name
73+
type: process_name
4274
tags:
4375
analytic_story:
4476
- Active Directory Discovery
77+
- LAMEHUG
4578
asset_type: Endpoint
4679
mitre_attack_id:
4780
- T1087.002
@@ -53,6 +86,7 @@ tags:
5386
tests:
5487
- name: True Positive Test
5588
attack_data:
56-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
89+
- data:
90+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
5791
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
5892
sourcetype: XmlWinEventLog

‎detections/endpoint/domain_group_discovery_with_dsquery.yml‎

Lines changed: 56 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
name: Domain Group Discovery With Dsquery
22
id: f0c9d62f-a232-4edd-b17e-bc409fb133d4
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-08-27'
55
author: Mauricio Velazco, Splunk
66
status: production
7-
type: Hunting
8-
description: The following analytic identifies the execution of `dsquery.exe` with
9-
command-line arguments used to query for domain groups. It leverages Endpoint Detection
10-
and Response (EDR) data, focusing on process names and command-line arguments. This
11-
activity is significant because both Red Teams and adversaries use `dsquery.exe`
12-
to enumerate domain groups, gaining situational awareness and facilitating further
13-
Active Directory discovery. If confirmed malicious, this behavior could allow attackers
14-
to map out the domain structure, identify high-value targets, and plan subsequent
15-
attacks, potentially leading to privilege escalation or data exfiltration.
7+
type: Anomaly
8+
description: The following analytic identifies the execution of `dsquery.exe`
9+
with command-line arguments used to query for domain groups. It leverages
10+
Endpoint Detection and Response (EDR) data, focusing on process names and
11+
command-line arguments. This activity is significant because both Red Teams
12+
and adversaries use `dsquery.exe` to enumerate domain groups, gaining
13+
situational awareness and facilitating further Active Directory discovery. If
14+
confirmed malicious, this behavior could allow attackers to map out the domain
15+
structure, identify high-value targets, and plan subsequent attacks,
16+
potentially leading to privilege escalation or data exfiltration.
1617
data_source:
1718
- Sysmon EventID 1
1819
- Windows Event Log Security 4688
@@ -26,21 +27,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2627
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
2728
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
2829
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter`'
29-
how_to_implement: The detection is based on data that originates from Endpoint Detection
30-
and Response (EDR) agents. These agents are designed to provide security-related
31-
telemetry from the endpoints where the agent is installed. To implement this search,
32-
you must ingest logs that contain the process GUID, process name, and parent process.
33-
Additionally, you must ingest complete command-line executions. These logs must
34-
be processed using the appropriate Splunk Technology Add-ons that are specific to
35-
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
36-
data model. Use the Splunk Common Information Model (CIM) to normalize the field
37-
names and speed up the data modeling process.
38-
known_false_positives: Administrators or power users may use this command for troubleshooting.
30+
how_to_implement: The detection is based on data that originates from Endpoint
31+
Detection and Response (EDR) agents. These agents are designed to provide
32+
security-related telemetry from the endpoints where the agent is installed. To
33+
implement this search, you must ingest logs that contain the process GUID,
34+
process name, and parent process. Additionally, you must ingest complete
35+
command-line executions. These logs must be processed using the appropriate
36+
Splunk Technology Add-ons that are specific to the EDR product. The logs must
37+
also be mapped to the `Processes` node of the `Endpoint` data model. Use the
38+
Splunk Common Information Model (CIM) to normalize the field names and speed
39+
up the data modeling process.
40+
known_false_positives: Administrators or power users may use this command for
41+
troubleshooting.
3942
references:
4043
- https://attack.mitre.org/techniques/T1069/002/
44+
drilldown_searches:
45+
- name: View the detection results for - "$user$" and "$dest$"
46+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
50+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
51+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
52+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
53+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
54+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
55+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
56+
earliest_offset: $info_min_time$
57+
latest_offset: $info_max_time$
58+
rba:
59+
message: An instance of $parent_process_name$ spawning $process_name$ was identified
60+
on endpoint $dest$ by user $user$.
61+
risk_objects:
62+
- field: user
63+
type: user
64+
score: 3
65+
- field: dest
66+
type: system
67+
score: 3
68+
threat_objects:
69+
- field: parent_process_name
70+
type: parent_process_name
71+
- field: process_name
72+
type: process_name
4173
tags:
4274
analytic_story:
4375
- Active Directory Discovery
76+
- LAMEHUG
4477
asset_type: Endpoint
4578
mitre_attack_id:
4679
- T1069.002
@@ -52,6 +85,7 @@ tags:
5285
tests:
5386
- name: True Positive Test
5487
attack_data:
55-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log
88+
- data:
89+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log
5690
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
5791
sourcetype: XmlWinEventLog

‎detections/endpoint/remote_system_discovery_with_dsquery.yml‎

Lines changed: 56 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
name: Remote System Discovery with Dsquery
22
id: 9fb562f4-42f8-4139-8e11-a82edf7ed718
3-
version: 6
4-
date: '2025-05-02'
3+
version: 7
4+
date: '2025-08-27'
55
author: Mauricio Velazco, Splunk
66
status: production
7-
type: Hunting
8-
description: The following analytic detects the execution of `dsquery.exe` with the
9-
`computer` argument, which is used to discover remote systems within a domain. This
10-
detection leverages data from Endpoint Detection and Response (EDR) agents, focusing
11-
on process names and command-line arguments. Remote system discovery is significant
12-
as it indicates potential reconnaissance activities by adversaries or Red Teams
13-
to map out network resources and Active Directory structures. If confirmed malicious,
14-
this activity could lead to further exploitation, lateral movement, and unauthorized
15-
access to critical systems within the network.
7+
type: Anomaly
8+
description: The following analytic detects the execution of `dsquery.exe` with
9+
the `computer` argument, which is used to discover remote systems within a
10+
domain. This detection leverages data from Endpoint Detection and Response
11+
(EDR) agents, focusing on process names and command-line arguments. Remote
12+
system discovery is significant as it indicates potential reconnaissance
13+
activities by adversaries or Red Teams to map out network resources and Active
14+
Directory structures. If confirmed malicious, this activity could lead to
15+
further exploitation, lateral movement, and unauthorized access to critical
16+
systems within the network.
1617
data_source:
1718
- Sysmon EventID 1
1819
- Windows Event Log Security 4688
@@ -26,22 +27,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2627
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
2728
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
2829
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_dsquery_filter`'
29-
how_to_implement: The detection is based on data that originates from Endpoint Detection
30-
and Response (EDR) agents. These agents are designed to provide security-related
31-
telemetry from the endpoints where the agent is installed. To implement this search,
32-
you must ingest logs that contain the process GUID, process name, and parent process.
33-
Additionally, you must ingest complete command-line executions. These logs must
34-
be processed using the appropriate Splunk Technology Add-ons that are specific to
35-
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
36-
data model. Use the Splunk Common Information Model (CIM) to normalize the field
37-
names and speed up the data modeling process.
38-
known_false_positives: Administrators or power users may use this command for troubleshooting.
30+
how_to_implement: The detection is based on data that originates from Endpoint
31+
Detection and Response (EDR) agents. These agents are designed to provide
32+
security-related telemetry from the endpoints where the agent is installed. To
33+
implement this search, you must ingest logs that contain the process GUID,
34+
process name, and parent process. Additionally, you must ingest complete
35+
command-line executions. These logs must be processed using the appropriate
36+
Splunk Technology Add-ons that are specific to the EDR product. The logs must
37+
also be mapped to the `Processes` node of the `Endpoint` data model. Use the
38+
Splunk Common Information Model (CIM) to normalize the field names and speed
39+
up the data modeling process.
40+
known_false_positives: Administrators or power users may use this command for
41+
troubleshooting.
3942
references:
4043
- https://attack.mitre.org/techniques/T1018/
4144
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
45+
drilldown_searches:
46+
- name: View the detection results for - "$user$" and "$dest$"
47+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
48+
earliest_offset: $info_min_time$
49+
latest_offset: $info_max_time$
50+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
51+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
52+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
53+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
54+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
55+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
56+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
57+
earliest_offset: $info_min_time$
58+
latest_offset: $info_max_time$
59+
rba:
60+
message: An instance of $parent_process_name$ spawning $process_name$ was identified
61+
on endpoint $dest$ by user $user$.
62+
risk_objects:
63+
- field: user
64+
type: user
65+
score: 3
66+
- field: dest
67+
type: system
68+
score: 3
69+
threat_objects:
70+
- field: parent_process_name
71+
type: parent_process_name
72+
- field: process_name
73+
type: process_name
4274
tags:
4375
analytic_story:
4476
- Active Directory Discovery
77+
- LAMEHUG
4578
asset_type: Endpoint
4679
mitre_attack_id:
4780
- T1018
@@ -53,6 +86,7 @@ tags:
5386
tests:
5487
- name: True Positive Test
5588
attack_data:
56-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log
89+
- data:
90+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log
5791
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
5892
sourcetype: XmlWinEventLog

‎detections/endpoint/system_information_discovery_detection.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: System Information Discovery Detection
22
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
3-
version: 10
4-
date: '2025-07-28'
3+
version: 11
4+
date: '2025-08-27'
55
author: Patrick Bareiss, Splunk
66
status: production
77
type: TTP
@@ -82,6 +82,7 @@ tags:
8282
- BlackSuit Ransomware
8383
- Cleo File Transfer Software
8484
- Interlock Ransomware
85+
- LAMEHUG
8586
asset_type: Windows
8687
mitre_attack_id:
8788
- T1082

0 commit comments

Comments
 (0)