Skip to content

Commit efa8b09

Browse files
nasbenchnasbench
committed
update powershell analytics
1 parent 7e2a387 commit efa8b09

26 files changed

+240
-92
lines changed

‎detections/endpoint/detect_critical_alerts_from_security_tools.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
name: Detect Critical Alerts from Security Tools
22
id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
3-
version: 1
4-
date: '2024-10-09'
3+
version: 2
4+
date: '2025-01-13'
55
author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
88
data_source:
99
- Windows Defender Alerts
1010
- MS365 Defender Incident Alerts
11-
description: The following analytics is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
11+
description: The following analytic has been deprecated in favour of specific and dedicated product analytics such as "Microsoft Defender ATP Alerts". The following analytic is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
1212
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`'
1313
how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. The risk_score field is used to calculate the risk score for the alerts and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework is dynamically created by the detection when this is triggered. These fields need not be set in the adaptive response actions.
1414
known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment.

‎detections/endpoint/excel_spawning_powershell.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Excel Spawning PowerShell
22
id: 42d40a22-9be3-11eb-8f08-acde48001122
3-
version: '6'
4-
date: '2024-11-28'
3+
version: 7
4+
date: '2025-01-13'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects Microsoft Excel spawning PowerShell, an
8+
description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process".
9+
The following analytic detects Microsoft Excel spawning PowerShell, an
910
uncommon and suspicious behavior. This detection leverages data from Endpoint Detection
1011
and Response (EDR) agents, focusing on process creation events where the parent
1112
process is "excel.exe" and the child process is PowerShell. This activity is significant

‎detections/endpoint/excel_spawning_windows_script_host.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Excel Spawning Windows Script Host
22
id: 57fe880a-9be3-11eb-9bf3-acde48001122
3-
version: '6'
4-
date: '2024-11-28'
3+
version: 7
4+
date: '2025-01-13'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
8-
description: The following analytic identifies instances where Microsoft Excel spawns
8+
description: The following analytic has been deprecated in favour of a more generic approach.
9+
The following analytic identifies instances where Microsoft Excel spawns
910
Windows Script Host processes (`cscript.exe` or `wscript.exe`). This behavior is
1011
detected using Endpoint Detection and Response (EDR) telemetry, focusing on process
1112
creation events where the parent process is `excel.exe`. This activity is significant

‎detections/endpoint/microsoft_defender_atp_alerts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_ex
1515
| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description src
1616
| `security_content_ctime(firstTime)`
1717
| `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`'
18-
how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype. **NOTE** - We also have a detection named `Detect Critical Alerts from Security Tools` that triggers on the same data and is written against the Alerts datamodel. Enabling both of these detections will result in duplicate risk/notable events, we recommend enabling only one of these detections.
18+
how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype.
1919
known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment.
2020
references:
2121
- https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide

‎detections/endpoint/microsoft_defender_incident_alerts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "url"))
2121
| eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "fileName"))
2222
| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50, true(), 2)
2323
| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`'
24-
how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype. **NOTE** - We also have a detection named `Detect Critical Alerts from Security Tools` that triggers on the same data and is written against the Alerts datamodel. Enabling both of these detections will result in duplicate risk/notable events, we recommend enabling only one of these detections.
24+
how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype.
2525
known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment.
2626
references:
2727
- https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide

‎detections/endpoint/office_application_spawn_regsvr32_process.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Office Application Spawn Regsvr32 process
22
id: 2d9fc90c-f11f-11eb-9300-acde48001122
3-
version: '7'
4-
date: '2024-11-28'
3+
version: 8
4+
date: '2025-01-13'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic identifies instances where an Office application
8+
description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process".
9+
The following analytic identifies instances where an Office application
910
spawns a Regsvr32 process, which is often indicative of macro execution or malicious
1011
code. This detection leverages data from Endpoint Detection and Response (EDR) agents,
1112
focusing on process creation events where the parent process is a known Office application.

‎detections/endpoint/office_application_spawn_rundll32_process.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Office Application Spawn rundll32 process
22
id: 958751e4-9c5f-11eb-b103-acde48001122
3-
version: '7'
4-
date: '2024-11-28'
3+
version: 8
4+
date: '2025-01-13'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic identifies instances where an Office application
8+
description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process".
9+
The following analytic identifies instances where an Office application
910
spawns a rundll32 process, which is often indicative of macro execution or malicious
1011
code. This detection leverages data from Endpoint Detection and Response (EDR) agents,
1112
focusing on process creation events where the parent process is a known Office application.

‎detections/endpoint/office_product_spawn_cmd_process.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Office Product Spawn CMD Process
22
id: b8b19420-e892-11eb-9244-acde48001122
3-
version: 7
4-
date: '2024-09-30'
3+
version: 8
4+
date: '2025-01-13'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities.
8+
description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process".
9+
The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities.
910
data_source:
1011
- Sysmon EventID 1
1112
- Windows Event Log Security 4688

‎detections/endpoint/office_product_spawning_bitsadmin.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Office Product Spawning BITSAdmin
22
id: e8c591f4-a6d7-11eb-8cf7-acde48001122
3-
version: '8'
4-
date: '2024-11-28'
3+
version: 9
4+
date: '2025-01-13'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects any Windows Office Product spawning `bitsadmin.exe`,
8+
description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process".
9+
The following analytic detects any Windows Office Product spawning `bitsadmin.exe`,
910
a behavior often associated with malware families like TA551 and IcedID. This detection
1011
leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
1112
and parent process relationships. This activity is significant because `bitsadmin.exe`

‎detections/endpoint/office_product_spawning_certutil.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Office Product Spawning CertUtil
22
id: 6925fe72-a6d5-11eb-9e17-acde48001122
3-
version: '8'
4-
date: '2024-11-28'
3+
version: 9
4+
date: '2025-01-13'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects any Windows Office Product spawning `certutil.exe`,
8+
description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process".
9+
The following analytic detects any Windows Office Product spawning `certutil.exe`,
910
a behavior often associated with malware families like TA551 and IcedID. This detection
1011
leverages Endpoint Detection and Response (EDR) data, focusing on process relationships
1112
and command-line executions. The significance lies in the fact that `certutil.exe`

0 commit comments

Comments
 (0)