From db80e83118a73dff0e73c94e4f3c4e4269c7a369 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sat, 11 Nov 2023 10:47:36 -0500
Subject: [PATCH 1/4] Initial upload

---
 .../detect_password_spray_attack_behavior.yml | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 detections/endpoint/detect_password_spray_attack_behavior.yml

diff --git a/detections/endpoint/detect_password_spray_attack_behavior.yml b/detections/endpoint/detect_password_spray_attack_behavior.yml
new file mode 100644
index 0000000000..2b29cefa2e
--- /dev/null
+++ b/detections/endpoint/detect_password_spray_attack_behavior.yml
@@ -0,0 +1,63 @@
+name: Detect Password Spray Attack Behavior
+id: b6391b15-e913-4c2c-8949-9eecc06efacc
+version: 1
+date: '2023-10-30'
+author: Steven Dick
+status: production
+type: TTP
+description:'The following analytic identifies one source failing to authenticate with 10 or more unique users. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises and works well against any number of data sources ingested into the CIM datamodel.
+
+Environments can be very different depending on the organization. Test and customize this detections thresholds if needed.'
+data_source:
+- Authentication Events (various)
+search: '| tstats `summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication by Authentication.action,Authentication.src,Authentication.user | `drop_dm_object_name("Authentication")` | eval  user=replace(upper(user),"@.+",""), success=if(action="success",count,0),success_user=if(action="success",user,null),failure=if(action="failure",count,0), failed_user=if(action="failure",user,null) | `detect_password_spray_attack_behavior_filter` | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_user) as user values(failed_user) as failed_user dc(success_user) as success_dc dc(failed_user) as failed_dc dc(user) as user_dc ,sum(failure) as failure,sum(success) as success by src | fields - _time | where user_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+how_to_implement: This detection requires ingesting authentication data to the appropriate accelerated datamodel. Recommend adjusting the search time window for this correlation to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs
+known_false_positives: Domain controllers, authentication chokepoints, and vulnerability scanners.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.microsoft.com/en-us/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+- https://github.com/MarkoH17/Spray365
+tags:
+  analytic_story:
+  - Compromised User Account
+  asset_type: Access
+  confidence: 75
+  impact: 80
+  message: The source [$src$] attempted to access $user_dc$ distinct users a total of $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: falied_user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.user_category
+  - Authentication.src_category
+  - Authentication.app
+  - Authentication.action
+  - Authentication.src
+  - Authentication.user
+  risk_score: 60
+  security_domain: access
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From e7a325ab6335e594f15f6ad7082519eeb4085b6b Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Mon, 17 Jun 2024 09:57:16 -0400
Subject: [PATCH 2/4] Additional detection added

---
 ...ord_spray_attack_behavior_from_source.yml} | 16 +++--
 ...password_spray_attack_behavior_on_user.yml | 71 +++++++++++++++++++
 2 files changed, 83 insertions(+), 4 deletions(-)
 rename detections/endpoint/{detect_password_spray_attack_behavior.yml => detect_password_spray_attack_behavior_from_source.yml} (67%)
 create mode 100644 detections/endpoint/detect_password_spray_attack_behavior_on_user.yml

diff --git a/detections/endpoint/detect_password_spray_attack_behavior.yml b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
similarity index 67%
rename from detections/endpoint/detect_password_spray_attack_behavior.yml
rename to detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
index 2b29cefa2e..599ca65e8a 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
@@ -1,16 +1,24 @@
-name: Detect Password Spray Attack Behavior
+name: Detect Password Spray Attack Behavior From Source
 id: b6391b15-e913-4c2c-8949-9eecc06efacc
 version: 1
 date: '2023-10-30'
 author: Steven Dick
 status: production
 type: TTP
-description:'The following analytic identifies one source failing to authenticate with 10 or more unique users. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises and works well against any number of data sources ingested into the CIM datamodel.
+description: The following analytic identifies one source failing to authenticate with 10 or more unique users. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises and works well against any number of data sources ingested into the CIM datamodel.
 
-Environments can be very different depending on the organization. Test and customize this detections thresholds if needed.'
+Environments can be very different depending on the organization. Test and customize this detections thresholds if needed.
 data_source:
 - Authentication Events (various)
-search: '| tstats `summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication by Authentication.action,Authentication.src,Authentication.user | `drop_dm_object_name("Authentication")` | eval  user=replace(upper(user),"@.+",""), success=if(action="success",count,0),success_user=if(action="success",user,null),failure=if(action="failure",count,0), failed_user=if(action="failure",user,null) | `detect_password_spray_attack_behavior_filter` | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_user) as user values(failed_user) as failed_user dc(success_user) as success_dc dc(failed_user) as failed_dc dc(user) as user_dc ,sum(failure) as failure,sum(success) as success by src | fields - _time | where user_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+search: '| tstats `summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user
+| `drop_dm_object_name("Authentication")`
+| eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), src=upper(src), success=if(action="success",count,0),success_user=if(action="success",user,null),failure=if(action="failure",count,0), failed_user=if(action="failure",user,null)
+| `detect_password_spray_attack_behavior_from_source_filter`
+| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_user) as user values(failed_user) as failed_user dc(success_user) as success_dc dc(failed_user) as failed_dc dc(user) as user_dc ,sum(failure) as failure,sum(success) as success by src
+| fields - _time
+| where user_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`'
 how_to_implement: This detection requires ingesting authentication data to the appropriate accelerated datamodel. Recommend adjusting the search time window for this correlation to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs
 known_false_positives: Domain controllers, authentication chokepoints, and vulnerability scanners.
 references:
diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
new file mode 100644
index 0000000000..bb6a55d5f6
--- /dev/null
+++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
@@ -0,0 +1,71 @@
+name: Detect Password Spray Attack On User
+id: a7539705-7183-4a12-9b6a-b6eef645a6d7
+version: 1
+date: '2023-10-30'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies any user failing to authenticate from 10 or more unique sources. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises.
+
+Environments can be very different depending on the organization. Test and customize this detections thresholds as needed
+data_source:
+- Authentication Events (various)
+search: '| tstats `summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user
+| `drop_dm_object_name("Authentication")`
+| eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), success=if(action="success",count,0), src=upper(src), success_src=if(action="success",src,null), failure=if(action="failure",count,0), failed_src=if(action="failure",src,null)
+| `detect_password_spray_attack_behavior_on_user_filter`
+| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_src) as src values(failed_src) as failed_src dc(success_src) as success_dc dc(failed_src) as failed_dc dc(src) as src_dc, sum(failure) as failure, sum(success) as success by user
+| fields - _time
+| where src_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`'
+how_to_implement: This detection requires ingesting authentication data to the appropriate accelerated datamodel. Recommend adjusting the search time window for this correlation to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs
+known_false_positives: Domain controllers, authentication chokepoints, and vulnerability scanners.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.microsoft.com/en-us/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+- https://github.com/MarkoH17/Spray365
+tags:
+  analytic_story:
+  - Compromised User Account
+  asset_type: Access
+  confidence: 75
+  impact: 80
+  message: A total of $src_dc$ distinct sources attempted to access the account [$user$], $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: falied_user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.user_category
+  - Authentication.src_category
+  - Authentication.app
+  - Authentication.action
+  - Authentication.src
+  - Authentication.user
+  risk_score: 60
+  security_domain: access
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/003/passwprd_spray_attack/windows_events.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From c5f0ade2bc13130e3d75ad57dd5caa693d3dac10 Mon Sep 17 00:00:00 2001
From: ljstella <lstella@splunk.com>
Date: Mon, 29 Jul 2024 10:55:18 -0500
Subject: [PATCH 3/4] Formatting and observables

---
 ..._password_spray_attack_behavior_from_source.yml | 10 ++++------
 ...tect_password_spray_attack_behavior_on_user.yml | 14 ++++----------
 2 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
index 599ca65e8a..e2314764bc 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
@@ -5,12 +5,10 @@ date: '2023-10-30'
 author: Steven Dick
 status: production
 type: TTP
-description: The following analytic identifies one source failing to authenticate with 10 or more unique users. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises and works well against any number of data sources ingested into the CIM datamodel.
-
-Environments can be very different depending on the organization. Test and customize this detections thresholds if needed.
+description: The following analytic identifies one source failing to authenticate with 10 or more unique users. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises and works well against any number of data sources ingested into the CIM datamodel. Environments can be very different depending on the organization. Test and customize this detections thresholds if needed.
 data_source:
 - Authentication Events (various)
-search: '| tstats `summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user
+search: '| tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user
 | `drop_dm_object_name("Authentication")`
 | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), src=upper(src), success=if(action="success",count,0),success_user=if(action="success",user,null),failure=if(action="failure",count,0), failed_user=if(action="failure",user,null)
 | `detect_password_spray_attack_behavior_from_source_filter`
@@ -28,7 +26,7 @@ references:
 tags:
   analytic_story:
   - Compromised User Account
-  asset_type: Access
+  asset_type: Account
   confidence: 75
   impact: 80
   message: The source [$src$] attempted to access $user_dc$ distinct users a total of $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
@@ -44,7 +42,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: falied_user
+  - name: failed_user
     type: User
     role:
     - Attacker
diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
index bb6a55d5f6..f590b22c1c 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
@@ -1,16 +1,14 @@
-name: Detect Password Spray Attack On User
+name: Detect Password Spray Attack Behavior On User
 id: a7539705-7183-4a12-9b6a-b6eef645a6d7
 version: 1
 date: '2023-10-30'
 author: Steven Dick
 status: production
 type: TTP
-description: The following analytic identifies any user failing to authenticate from 10 or more unique sources. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises.
-
-Environments can be very different depending on the organization. Test and customize this detections thresholds as needed
+description: The following analytic identifies any user failing to authenticate from 10 or more unique sources. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises. Environments can be very different depending on the organization. Test and customize this detections thresholds as needed
 data_source:
 - Authentication Events (various)
-search: '| tstats `summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user
+search: '| tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user
 | `drop_dm_object_name("Authentication")`
 | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), success=if(action="success",count,0), src=upper(src), success_src=if(action="success",src,null), failure=if(action="failure",count,0), failed_src=if(action="failure",src,null)
 | `detect_password_spray_attack_behavior_on_user_filter`
@@ -28,7 +26,7 @@ references:
 tags:
   analytic_story:
   - Compromised User Account
-  asset_type: Access
+  asset_type: Account
   confidence: 75
   impact: 80
   message: A total of $src_dc$ distinct sources attempted to access the account [$user$], $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
@@ -44,10 +42,6 @@ tags:
     type: User
     role:
     - Victim
-  - name: falied_user
-    type: User
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From aa7d9edcda8fde52bc82852a82a097e656a0d0e2 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Fri, 2 Aug 2024 08:31:12 -0400
Subject: [PATCH 4/4] Update detect_password_spray_attack_behavior_on_user.yml

derp wrong log
---
 .../detect_password_spray_attack_behavior_on_user.yml         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
index f590b22c1c..339965acb8 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
@@ -59,7 +59,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/003/passwprd_spray_attack/windows_events.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log
     source: XmlWinEventLog:Security
     sourcetype: XmlWinEventLog
-    update_timestamp: true
\ No newline at end of file
+    update_timestamp: true