Tune and Add More Context to Noisy Detections

data_sources/windows_event_log_security_4740.yml

@@ -0,0 +1,97 @@
+name: Windows Event Log Security 4740
+id: 387936fa-efa9-425d-9f1b-487425250ea9
+version: 1
+creation_date: '2026-09-08'
+modification_date: '2026-09-08'
+author: Nasreddine Bencherchali, Splunk
+description: Logs when a user account is locked out. It includes details about the account that was locked out, the subject, and additional information.
+mitre_components:
+    - User Account Metadata
+source: XmlWinEventLog:Security
+sourcetype: XmlWinEventLog
+separator: EventCode
+separator_value: '4740'
+supported_TA:
+    - name: Splunk Add-on for Microsoft Windows
+      url: https://splunkbase.splunk.com/app/742
+      version: 11.0.2
+fields:
+    - _time
+    - action
+    - app
+    - Caller_Domain
+    - Caller_User_Name
+    - Category
+    - change_type
+    - Channel
+    - Computer
+    - dest
+    - dest_nt_domain
+    - dvc
+    - dvc_nt_host
+    - Error_Code
+    - event_id
+    - event_time
+    - EventCode
+    - EventData_Xml
+    - EventID
+    - EventRecordID
+    - eventtype
+    - Guid
+    - host
+    - id
+    - Keywords
+    - Level
+    - linecount
+    - Logon_ID
+    - name
+    - Name
+    - object
+    - object_attrs
+    - object_category
+    - Opcode
+    - ProcessID
+    - product
+    - punct
+    - Record
+    - result
+    - session_id
+    - severity
+    - severity_id
+    - signature
+    - signature_id
+    - source
+    - sourcetype
+    - splunk_server
+    - src_nt_domain
+    - src_subject_user_id
+    - src_user
+    - src_user_name
+    - status
+    - subject
+    - SubjectDomainName
+    - SubjectLogonId
+    - SubjectUserName
+    - SubjectUserSid
+    - System_Props_Xml
+    - SystemTime
+    - ta_windows_action
+    - ta_windows_security_Category
+    - tag
+    - tag::eventtype
+    - Target_User_Name
+    - TargetSid
+    - TargetUserName
+    - Task
+    - TaskCategory
+    - ThreadID
+    - timestamp
+    - user
+    - user_group
+    - user_name
+    - vendor
+    - vendor_product
+    - Version
+output_fields:
+    - dest
+example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4740</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-02-02T00:44:42.720147400Z'/><EventRecordID>394306</EventRecordID><Correlation/><Execution ProcessID='600' ThreadID='752'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='TargetUserName'>test</Data><Data Name='TargetDomainName'></Data><Data Name='TargetSid'>ATTACKRANGE\test</Data><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-DC$</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0x3e7</Data></EventData></Event>

detections/endpoint/detect_excessive_user_account_lockouts.yml

@@ -1,26 +1,53 @@
 name: Detect Excessive User Account Lockouts
 id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
-version: 15
+version: 16
 creation_date: '2020-04-29'
-modification_date: '2026-05-13'
-author: David Dorsey, Splunk
+modification_date: '2026-09-08'
+author: David Dorsey, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network.
-data_source: []
+description: |-
+    The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window.
+    It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination.
+    This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials.
+    If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment.
+data_source:
+    - Windows Event Log Security 4740
 search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
-      WHERE All_Changes.result="*lock*"
-      BY All_Changes.user All_Changes.result
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+            values(All_Changes.result) as "Result"
+            values(All_Changes.action) as "Action"
+            values(All_Changes.object_category) as "Object Category"
+
+    FROM datamodel=Change.All_Changes WHERE
+
+    All_Changes.action="lockout"
+
+    BY _time span=5m
+       All_Changes.dest All_Changes.user
+
     | `drop_dm_object_name("All_Changes")`
     | `drop_dm_object_name("Account_Management")`
+
+    | eval lockout_count = 5
+    | where count > lockout_count
+
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
-    | search count > 5
     | `detect_excessive_user_account_lockouts_filter`
-how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.
-known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.
-references: []
+how_to_implement: |-
+    You must ingest your Windows Security Event Logs or similar data into the Change data model under the Account_Management node for this search to execute successfully.
+    The detection triggers when more than 5 account lockouts for the same user and destination occur within a 5-minute time bucket.
+    The lockout threshold and time window can be adjusted based on the authentication patterns and account-management practices in your environment.
+known_false_positives: |-
+    Legitimate users may generate multiple account lockouts after repeatedly entering an incorrect password.
+    False positives may also occur when pre-configured accounts continue attempting authentication with outdated stored credentials after a password change. This can commonly occur with credentials configured for printers, network shares, services, scheduled tasks, applications, mapped drives, or other systems that automatically authenticate on behalf of a user.
+references:
+    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4740
+    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold
+    - https://techcommunity.microsoft.com/blog/microsoft-security-baselines/configuring-account-lockout/701040/
 drilldown_searches:
     - name: View the detection results for - "$user$"
       search: '%original_detection_search% | search  user = "$user$"'
@@ -35,7 +62,7 @@ intermediate_findings:
         - field: user
           type: user
           score: 20
-          message: Excessive user account lockouts for $user$ in a short period of time
+          message: User [$user$] experienced more than [$lockout_count$] account lockouts within a 5-minute time window.
 analytic_story:
     - Active Directory Password Spraying
     - Scattered Lapsus$ Hunters

detections/network/prohibited_network_traffic_allowed.yml

@@ -1,30 +1,56 @@
 name: Prohibited Network Traffic Allowed
 id: ce5a0962-849f-4720-a678-753fe6674479
-version: 14
+version: 15
 creation_date: '2020-04-29'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Rico Valdez, Splunk
 status: production
-type: TTP
-description: The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
+type: Anomaly
+description: |-
+    The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed.
+    It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies.
+    This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration.
+    If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
-      WHERE All_Traffic.action IN ("allowed", "allow") [
-    | inputlookup interesting_ports_lookup where is_prohibited="true"
-    | table dest_port transport
-    | dedup dest_port transport
-    | rename dest_port as All_Traffic.dest_port
-    | rename transport as All_Traffic.transport] by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+            values(All_Traffic.src_port) as src_port
+            values(All_Traffic.action) as action
+            values(All_Traffic.rule) as rule
+
+    FROM datamodel=Network_Traffic WHERE
+
+    All_Traffic.action IN ("allowed", "allow")
+    [
+        | inputlookup interesting_ports_lookup where is_prohibited="true"
+        | table dest_port transport
+        | dedup dest_port transport
+        | rename dest_port as All_Traffic.dest_port
+        | rename transport as All_Traffic.transport
+    ]
+
+    by All_Traffic.src_ip All_Traffic.dest_ip
+       All_Traffic.dest_port All_Traffic.dvc
+       All_Traffic.vendor_product
+
     | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note
+
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `drop_dm_object_name("All_Traffic")`
     | `prohibited_network_traffic_allowed_filter`
-how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated.
-known_false_positives: No false positives have been identified at this time.
-references: []
+how_to_implement: |-
+    In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment.
+    This is necessary so that the search can identify an 'action' taken on the traffic of interest.
+    The search also requires the Network_Traffic data model be populated.
+known_false_positives: |-
+    The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed.
+references:
+    - https://securityscorecard.com/blog/ftp-security-risks/
+    - https://secoraconsulting.com/blog/telnet-security-risks/
 drilldown_searches:
     - name: View the detection results for - "$src_ip$"
       search: '%original_detection_search% | search  src_ip = "$src_ip$"'
@@ -34,12 +60,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
-finding:
-    title: Potentially Prohibited Network Traffic allowed from $src_ip$
-    entity:
-        field: src_ip
-        type: system
-        score: 50
+intermediate_findings:
+    entities:
+        - field: src_ip
+          type: system
+          score: 20
+          message: Potentially Prohibited Network Traffic on Port [$dest_port$] via Protocol [$transport$] allowed from [$src_ip$].
 threat_objects:
     - field: dest_ip
       type: ip_address
@@ -57,13 +83,10 @@ product:
     - Splunk Cloud
 category: network
 security_domain: network
-baselines:
-    - Count of Unique IPs Connecting to Ports
 tests:
     - name: Cisco Secure Firewall True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
           source: not_applicable
           sourcetype: cisco:sfw:estreamer
-      description: PORTED MANUAL TEST - This detection uses a builtin lookup from Enterprise Security.
-      test_type: experimental
+      test_type: unit