Techniques
Sample rules
Monitor DNS For Brand Abuse
- source: splunk
- technicques:
Description
This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse.
Detection logic
| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query
| `drop_dm_object_name("DNS")`
| `security_content_ctime(firstTime)`
| `brand_abuse_dns`
| `monitor_dns_for_brand_abuse_filter`
Monitor Web Traffic For Brand Abuse
- source: splunk
- technicques:
Description
The following analytic identifies web requests to domains that closely resemble your monitored brand’s domain, indicating potential brand abuse. It leverages data from web traffic sources, such as web proxies or network traffic analysis tools, and cross-references these with known domain permutations generated by the “ESCU - DNSTwist Domain Names” search. This activity is significant as it can indicate phishing attempts or other malicious activities targeting your brand. If confirmed malicious, attackers could deceive users, steal credentials, or distribute malware, leading to significant reputational and financial damage.
Detection logic
| tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| `brand_abuse_web`
| `monitor_web_traffic_for_brand_abuse_filter`
TOR Traffic
- source: splunk
- technicques:
- T1090
- T1090.003
Description
The following analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities. It leverages data from Next Generation Firewalls, using the Network_Traffic data model to detect traffic where the application is TOR and the action is allowed. This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination. If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `drop_dm_object_name("All_Traffic")`
| `tor_traffic_filter`
Email Attachments With Lots Of Spaces
- source: splunk
- technicques:
Description
The following analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. It leverages the Email data model to identify attachments where the ratio of spaces to the total file name length exceeds 10%. This behavior is significant as it may indicate an attempt to bypass security filters and deliver malicious payloads. If confirmed malicious, this activity could lead to the execution of harmful code or unauthorized access to sensitive information within the recipient’s environment.
Detection logic
| tstats `security_content_summariesonly` count values(All_Email.recipient) as recipient_address min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `drop_dm_object_name("All_Email")`
| eval space_ratio = (mvcount(split(file_name," "))-1)/len(file_name)
| search space_ratio >= 0.1
| rex field=recipient_address "(?<recipient_user>.*)@"
| `email_attachments_with_lots_of_spaces_filter`
Monitor Email For Brand Abuse
- source: splunk
- technicques:
Description
The following analytic identifies emails claiming to be sent from a domain similar to one you are monitoring for potential abuse. It leverages email header data, specifically the sender’s address, and cross-references it with a lookup table of known domain permutations generated by the “ESCU - DNSTwist Domain Names” search. This activity is significant as it can indicate phishing attempts or brand impersonation, which are common tactics used in social engineering attacks. If confirmed malicious, this could lead to unauthorized access, data theft, or reputational damage.
Detection logic
| tstats `security_content_summariesonly` values(All_Email.recipient) as recipients, min(_time) as firstTime, max(_time) as lastTime from datamodel=Email by All_Email.src_user, All_Email.message_id
| `drop_dm_object_name("All_Email")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| eval temp=split(src_user, "@")
| eval email_domain=mvindex(temp, 1)
| lookup update=true brandMonitoring_lookup domain as email_domain OUTPUT domain_abuse
| search domain_abuse=true
| table message_id, src_user, email_domain, recipients, firstTime, lastTime
| `monitor_email_for_brand_abuse_filter`