From 8719f6185d77a52cc3f72636463c3085e67970ac Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 8 Sep 2026 20:51:37 +0200 Subject: [PATCH] first update batch --- .../windows_event_log_security_4740.yml | 97 +++++++++++++++++++ ...detect_excessive_user_account_lockouts.yml | 53 +++++++--- .../prohibited_network_traffic_allowed.yml | 71 +++++++++----- 3 files changed, 184 insertions(+), 37 deletions(-) create mode 100644 data_sources/windows_event_log_security_4740.yml diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml new file mode 100644 index 0000000000..f085e94675 --- /dev/null +++ b/data_sources/windows_event_log_security_4740.yml @@ -0,0 +1,97 @@ +name: Windows Event Log Security 4740 +id: 387936fa-efa9-425d-9f1b-487425250ea9 +version: 1 +creation_date: '2026-09-08' +modification_date: '2026-09-08' +author: Nasreddine Bencherchali, Splunk +description: Logs when a user account is locked out. It includes details about the account that was locked out, the subject, and additional information. +mitre_components: + - User Account Metadata +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '4740' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - Category + - change_type + - Channel + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - Keywords + - Level + - linecount + - Logon_ID + - name + - Name + - object + - object_attrs + - object_category + - Opcode + - ProcessID + - product + - punct + - Record + - result + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_Category + - tag + - tag::eventtype + - Target_User_Name + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_group + - user_name + - vendor + - vendor_product + - Version +output_fields: + - dest +example_log: 4740001382400x8020000000000000394306Securityar-win-dc.attackrange.localtestATTACKRANGE\testNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7 diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index c78c5143c4..5cb6d13d5e 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,26 +1,53 @@ name: Detect Excessive User Account Lockouts id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -version: 15 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: David Dorsey, Splunk +modification_date: '2026-09-08' +author: David Dorsey, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network. -data_source: [] +description: |- + The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window. + It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination. + This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials. + If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment. +data_source: + - Windows Event Log Security 4740 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes - WHERE All_Changes.result="*lock*" - BY All_Changes.user All_Changes.result + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Changes.result) as "Result" + values(All_Changes.action) as "Action" + values(All_Changes.object_category) as "Object Category" + + FROM datamodel=Change.All_Changes WHERE + + All_Changes.action="lockout" + + BY _time span=5m + All_Changes.dest All_Changes.user + | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Account_Management")` + + | eval lockout_count = 5 + | where count > lockout_count + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | search count > 5 | `detect_excessive_user_account_lockouts_filter` -how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. -known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. -references: [] +how_to_implement: |- + You must ingest your Windows Security Event Logs or similar data into the Change data model under the Account_Management node for this search to execute successfully. + The detection triggers when more than 5 account lockouts for the same user and destination occur within a 5-minute time bucket. + The lockout threshold and time window can be adjusted based on the authentication patterns and account-management practices in your environment. +known_false_positives: |- + Legitimate users may generate multiple account lockouts after repeatedly entering an incorrect password. + False positives may also occur when pre-configured accounts continue attempting authentication with outdated stored credentials after a password change. This can commonly occur with credentials configured for printers, network shares, services, scheduled tasks, applications, mapped drives, or other systems that automatically authenticate on behalf of a user. +references: + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4740 + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold + - https://techcommunity.microsoft.com/blog/microsoft-security-baselines/configuring-account-lockout/701040/ drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -35,7 +62,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Excessive user account lockouts for $user$ in a short period of time + message: User [$user$] experienced more than [$lockout_count$] account lockouts within a 5-minute time window. analytic_story: - Active Directory Password Spraying - Scattered Lapsus$ Hunters diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 155b55babb..8f68a97364 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,30 +1,56 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 14 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Rico Valdez, Splunk status: production -type: TTP -description: The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. +type: Anomaly +description: |- + The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. + It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. + This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. + If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic - WHERE All_Traffic.action IN ("allowed", "allow") [ - | inputlookup interesting_ports_lookup where is_prohibited="true" - | table dest_port transport - | dedup dest_port transport - | rename dest_port as All_Traffic.dest_port - | rename transport as All_Traffic.transport] by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Traffic.src_port) as src_port + values(All_Traffic.action) as action + values(All_Traffic.rule) as rule + + FROM datamodel=Network_Traffic WHERE + + All_Traffic.action IN ("allowed", "allow") + [ + | inputlookup interesting_ports_lookup where is_prohibited="true" + | table dest_port transport + | dedup dest_port transport + | rename dest_port as All_Traffic.dest_port + | rename transport as All_Traffic.transport + ] + + by All_Traffic.src_ip All_Traffic.dest_ip + All_Traffic.dest_port All_Traffic.dvc + All_Traffic.vendor_product + | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter` -how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. -known_false_positives: No false positives have been identified at this time. -references: [] +how_to_implement: |- + In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. + This is necessary so that the search can identify an 'action' taken on the traffic of interest. + The search also requires the Network_Traffic data model be populated. +known_false_positives: |- + The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed. +references: + - https://securityscorecard.com/blog/ftp-security-risks/ + - https://secoraconsulting.com/blog/telnet-security-risks/ drilldown_searches: - name: View the detection results for - "$src_ip$" search: '%original_detection_search% | search src_ip = "$src_ip$"' @@ -34,12 +60,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Potentially Prohibited Network Traffic allowed from $src_ip$ - entity: - field: src_ip - type: system - score: 50 +intermediate_findings: + entities: + - field: src_ip + type: system + score: 20 + message: Potentially Prohibited Network Traffic on Port [$dest_port$] via Protocol [$transport$] allowed from [$src_ip$]. threat_objects: - field: dest_ip type: ip_address @@ -57,13 +83,10 @@ product: - Splunk Cloud category: network security_domain: network -baselines: - - Count of Unique IPs Connecting to Ports tests: - name: Cisco Secure Firewall True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log source: not_applicable sourcetype: cisco:sfw:estreamer - description: PORTED MANUAL TEST - This detection uses a builtin lookup from Enterprise Security. - test_type: experimental + test_type: unit