Month: June 2023

Custom detection rule with the MITRE ATT&CK framework in Splunk

by
This entry is part 5 of 21 in the series Threat Detection Engineering

Views: 47Let’s walk through a practical example of creating a custom detection rule with the MITRE ATT&CK framework in Splunk. Example:Let’s say we want to create a detection rule for the technique T1566.001 – “Phishing: Spearphishing Attachment” from the MITRE ATT&CK framework. This technique involves targeted phishing attacks where attackers send malicious attachments via email … Read more

Detect brute force attacks using Splunk

by

Views: 51To detect brute force attacks using Splunk, you can create queries that monitor and analyze relevant log data. Here are some example Splunk queries that can help you identify potential brute force attack patterns: Explanation: This query searches for log entries containing the phrase “Failed password” and then groups them by the source IP … Read more

Suricata rules to detect Web application attacks

by

Views: 117Here are some examples of Suricata rules that can be used to detect web application attacks: 1. SQL Injection: 2. Cross-Site Scripting (XSS): 3. Remote File Inclusion (RFI): 4. Local File Inclusion (LFI): 5. Command Injection: 6. Server-Side Request Forgery (SSRF): These are just a few examples, and you can modify or create additional … Read more

DNS Tunneling attacks

by

Views: 22DNS tunneling is a technique used by attackers to bypass network security measures and exfiltrate data from a targeted network. It involves encapsulating unauthorized data within DNS (Domain Name System) queries or responses, allowing the attacker to transmit information through DNS channels. Here is a simplified diagram illustrating the DNS tunneling attack: Here’s an … Read more

Investigate SQLi attacks using Splunk

by
This entry is part 6 of 21 in the series Threat Detection Engineering

Views: 57Sure! Here are a few Splunk queries that can help detect web application attacks: Note: Replace <your_index> and <your_sourcetype> with the appropriate values from your Splunk environment. Also, make sure you have the corresponding lookup tables (sql_injection_keywords.csv, xss_keywords.csv, etc.) populated with relevant attack patterns. You may need to modify the queries based on your … Read more

Cybersecurity playbook for SOC

by

Views: 18Developing a comprehensive cybersecurity playbook for a Security Operations Center (SOC) requires a systematic approach to address various aspects of cybersecurity operations. Below is a suggested structure for a SOC playbook: 1. Introduction and Scope    – Provide an overview of the playbook’s purpose, target audience, and scope.    – Clearly define the responsibilities … Read more

Linux Privilege Escalation Techniques

by

Views: 20Linux privilege escalation techniques involve methods that allow a user to gain higher privileges or escalate their existing privileges to gain unauthorized access or perform actions they wouldn’t typically be allowed to do. It’s important to note that discussing these techniques can be considered unethical and potentially illegal if used for malicious purposes. However, … Read more

Splunk Threat Hunting – Windows Events

by

Views: 42When performing threat hunting using Splunk on Windows systems, there are several important queries you can use to identify potential threats and security incidents. Here are some examples: This query looks for event code 4688, which indicates process creation events. It filters out known Splunk-related processes to focus on potentially suspicious activities. This query … Read more

Windows Event IDs to monitor/investigation

by

Views: 17SOC (Security Operations Center) teams typically monitor various Windows event IDs to detect and respond to security incidents. While the specific event IDs may vary depending on the organization’s security policies and requirements, here are some commonly monitored Windows event IDs: It’s important to note that the specific event IDs to monitor may vary … Read more