Skip to content

Commit 3028bd3

Browse files
author
netevert
committedMar 3, 2020
Merge branch 'junk'
·
v.1.4.4v.1.3.0
2 parents 72565e6 + 55eaba0 commit 3028bd3

29 files changed

+4769
-4583
lines changed
 

‎hunting/workbooks/attack_drilldown.json

+1,416-1,401
Large diffs are not rendered by default.

‎hunting/workbooks/computer_drilldown.json

+39-20
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
"description": "Selects the time range for the drilldown",
2323
"isRequired": true,
2424
"value": {
25-
"durationMs": 86400000
25+
"durationMs": 5184000000
2626
},
2727
"typeSettings": {
2828
"selectableValues": [
@@ -88,6 +88,10 @@
8888
"typeSettings": {
8989
"additionalResourceOptions": []
9090
},
91+
"timeContext": {
92+
"durationMs": 0
93+
},
94+
"timeContextFromParameter": "time_range",
9195
"queryType": 0,
9296
"resourceType": "microsoft.operationalinsights/workspaces"
9397
}
@@ -102,7 +106,7 @@
102106
"type": 3,
103107
"content": {
104108
"version": "KqlItem/1.0",
105-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where isnotempty(technique_name)\r\n| summarize count() by technique_name, bin(TimeGenerated, 1h)",
109+
"query": "let process_path_create_whitelist = process_create_whitelist | project process_path;\r\nlet process_path_access_whitelist = process_access_whitelist | project process_path;\r\nlet process_path_dns_whitelist = dns_whitelist | project process_path;\r\nlet process_path_file_create_whitelist = file_create_whitelist | project process_path;\r\nlet process_path_image_load_whitelist = image_load_whitelist | project process_path;\r\nlet process_path_network_whitelist = network_whitelist | project process_path;\r\nlet process_path_pipe_whitelist = pipe_whitelist | project process_path;\r\nlet process_path_registry_whitelist = registry_whitelist | project process_path;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path_create_whitelist) and process_path !in~ (process_path_access_whitelist) and process_path !in~ (process_path_dns_whitelist) and process_path !in~ (process_path_file_create_whitelist) and process_path !in~ (process_path_image_load_whitelist) and process_path !in~ (process_path_network_whitelist) and process_path !in~ (process_path_pipe_whitelist) and process_path !in~ (process_path_registry_whitelist)\r\n| summarize count() by technique_name, bin(TimeGenerated, 1h)",
106110
"size": 0,
107111
"title": "Activity by technique",
108112
"timeContext": {
@@ -122,10 +126,11 @@
122126
"type": 3,
123127
"content": {
124128
"version": "KqlItem/1.0",
125-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 1\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, user_name, process_parent_path, process_path, file_name, process_parent_command_line, process_command_line, process_parent_guid, process_guid, hash_sha256, process_id, process_parent_id",
129+
"query": "let process_ppath_whitelist = process_create_whitelist | project process_parent_path;\r\nlet process_path_whitelist = process_create_whitelist | project process_path;\r\nlet command_line_whitelist = process_create_whitelist | project replace(\"'\", \"\", replace('\"', '', process_command_line));\r\nlet hash_whitelist = process_create_whitelist | project hash_sha256;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 1\r\n| where isnotempty(technique_name)\r\n| where process_parent_path !in~ (process_ppath_whitelist) and process_path !in~ (process_path_whitelist) and replace('\"', '', tostring(process_command_line)) !in~ (command_line_whitelist) and hash_sha256 !in~ (hash_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, user_name, process_parent_path, process_path, file_name, process_parent_command_line, process_command_line, process_parent_guid, process_guid, hash_sha256, process_id, process_parent_id",
126130
"size": 0,
127131
"showAnalytics": true,
128-
"title": "Process create",
132+
"title": "Process create (not whitelisted)",
133+
"noDataMessage": "No process create activity matching ATT&CK techniques for host",
129134
"timeContext": {
130135
"durationMs": 0
131136
},
@@ -336,7 +341,7 @@
336341
}
337342
]
338343
},
339-
"name": "query - 2",
344+
"name": "process-create-query",
340345
"styleSettings": {
341346
"progressStyle": "loader"
342347
}
@@ -345,10 +350,11 @@
345350
"type": 3,
346351
"content": {
347352
"version": "KqlItem/1.0",
348-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 10\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, target_process_path, process_granted_access, target_process_guid, process_id, target_process_id",
353+
"query": "let process_path_whitelist = process_access_whitelist | project process_path;\r\nlet target_process_path_whitelist = process_access_whitelist | project target_process_path;\r\nlet process_granted_access_whitelist = process_access_whitelist | project process_granted_access;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 10\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path_whitelist) and target_process_path !in~ (target_process_path_whitelist) and process_granted_access !in~ (process_granted_access_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, target_process_path, process_granted_access, target_process_guid, process_id, target_process_id",
349354
"size": 0,
350355
"showAnalytics": true,
351-
"title": "Process access",
356+
"title": "Process access (not whitelisted)",
357+
"noDataMessage": "No process access activity matching ATT&CK techniques for host",
352358
"timeContext": {
353359
"durationMs": 0
354360
},
@@ -494,10 +500,11 @@
494500
"type": 3,
495501
"content": {
496502
"version": "KqlItem/1.0",
497-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 11\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, file_name, process_guid, process_id",
503+
"query": "let file_name_whitelist = file_create_whitelist | project file_name;\r\nlet file_path_whitelist = file_create_whitelist | project file_path;\r\nlet proc_path_whitelist = file_create_whitelist | project process_path;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 11\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (proc_path_whitelist) and file_name !in~ (file_name_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, file_name, process_guid, process_id",
498504
"size": 0,
499505
"showAnalytics": true,
500-
"title": "File created",
506+
"title": "File created (not whitelisted)",
507+
"noDataMessage": "No file create activity matching ATT&CK techniques for host",
501508
"timeContext": {
502509
"durationMs": 0
503510
},
@@ -612,7 +619,7 @@
612619
]
613620
}
614621
},
615-
"name": "File-created-query",
622+
"name": "file-created-query",
616623
"styleSettings": {
617624
"progressStyle": "loader"
618625
}
@@ -621,10 +628,11 @@
621628
"type": 3,
622629
"content": {
623630
"version": "KqlItem/1.0",
624-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 7\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, module_loaded, module_is_signed, module_signature, module_signature_status, process_id, process_guid",
631+
"query": "let process_path__whitelist = image_load_whitelist | project process_path;\r\nlet driver_loaded_whitelist = image_load_whitelist | project driver_loaded;\r\nlet driver_signed_whitelist = image_load_whitelist | project driver_is_signed;\r\nlet drv_signature_whitelist = image_load_whitelist | project driver_signature;\r\nlet signat_status_whitelist = image_load_whitelist | project driver_signature_status;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 7\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path__whitelist) and module_loaded !in~ (driver_loaded_whitelist) and module_is_signed !in~ (driver_signed_whitelist) and module_signature !in~ (drv_signature_whitelist) and module_signature_status !in~ (signat_status_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, module_loaded, module_is_signed, module_signature, module_signature_status, process_id, process_guid",
625632
"size": 0,
626633
"showAnalytics": true,
627-
"title": "Image loaded",
634+
"title": "Image loaded (not whitelisted)",
635+
"noDataMessage": "No image loaded activity matching ATT&CK techniques for host",
628636
"timeContext": {
629637
"durationMs": 0
630638
},
@@ -782,10 +790,11 @@
782790
"type": 3,
783791
"content": {
784792
"version": "KqlItem/1.0",
785-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 3\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, user_name, process_path, process_id, process_guid, src_ip, dst_ip, dst_port, src_host_name, dst_host_name",
793+
"query": "let process_path_whitelist = network_whitelist | project process_path;\r\nlet src_ip_whitelist = network_whitelist | project src_ip;\r\nlet dst_ip_whitelist = network_whitelist | project dst_ip;\r\nlet dst_port_whitelist = network_whitelist | project dst_port;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 3\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path_whitelist) and src_ip !in~ (src_ip_whitelist) and dst_ip !in~ (dst_ip_whitelist) and dst_port !in~ (dst_port_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, user_name, process_path, process_id, process_guid, src_ip, dst_ip, dst_port, src_host_name, dst_host_name",
786794
"size": 0,
787795
"showAnalytics": true,
788-
"title": "Network connections",
796+
"title": "Network connections (not whitelisted)",
797+
"noDataMessage": "No network connection activity matching ATT&CK techniques for host",
789798
"timeContext": {
790799
"durationMs": 0
791800
},
@@ -964,10 +973,11 @@
964973
"type": 3,
965974
"content": {
966975
"version": "KqlItem/1.0",
967-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 12\r\n| where isnotempty(technique_name)| project TimeGenerated, technique_id, technique_name, phase_name, EventType, Computer, process_path, process_id, process_guid, registry_key_path",
976+
"query": "let event_type_whitelist = registry_whitelist | project event_type;\r\nlet process_path_whitelist = registry_whitelist | project process_path;\r\nlet registry_key_path_whitelist = registry_whitelist | project registry_key_path;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 12\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path_whitelist) and EventType !in~ (event_type_whitelist) and registry_key_path !in~ (registry_key_path_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, EventType, Computer, process_path, process_id, process_guid, registry_key_path",
968977
"size": 0,
969978
"showAnalytics": true,
970-
"title": "Registry access",
979+
"title": "Registry access (not whitelisted)",
980+
"noDataMessage": "No registry access activity matching ATT&CK techniques for host",
971981
"timeContext": {
972982
"durationMs": 0
973983
},
@@ -1102,10 +1112,11 @@
11021112
"type": 3,
11031113
"content": {
11041114
"version": "KqlItem/1.0",
1105-
"query": "Sysmon\r\n| where EventID == 17\r\n| where Computer contains \"{host}\"\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, pipe_name, process_path, process_guid, process_id",
1115+
"query": "let process_path_whitelist = pipe_whitelist | project process_path;\r\nlet pipe_name_whitelist = pipe_whitelist | project pipe_name;\r\nSysmon\r\n| where EventID == 17\r\n| where Computer contains \"{host}\"\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path_whitelist) and pipe_name !in~ (pipe_name_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, pipe_name, process_path, process_guid, process_id",
11061116
"size": 0,
11071117
"showAnalytics": true,
1108-
"title": "Pipes",
1118+
"title": "Pipes (not whitelisted)",
1119+
"noDataMessage": "No pipe create and connect activity matching ATT&CK techniques for host",
11091120
"timeContext": {
11101121
"durationMs": 0
11111122
},
@@ -1229,10 +1240,11 @@
12291240
"type": 3,
12301241
"content": {
12311242
"version": "KqlItem/1.0",
1232-
"query": "Sysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 22\r\n| where isnotempty(technique_name)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, dns_query_name, dns_query_status, dns_query_results, process_guid",
1243+
"query": "let host_whitelist = dns_whitelist | project host;\r\nlet process_whitelist = dns_whitelist | project process_path;\r\nlet query_whitelist = dns_whitelist | project query_name;\r\nSysmon\r\n| where Computer contains \"{host}\"\r\n| where EventID == 22\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_whitelist) and dns_query_name !in~ (query_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, dns_query_name, dns_query_status, dns_query_results, process_guid",
12331244
"size": 0,
12341245
"showAnalytics": true,
1235-
"title": "DNS queries",
1246+
"title": "DNS queries (not whitelisted)",
1247+
"noDataMessage": "No DNS activity matching ATT&CK techniques for host",
12361248
"timeContext": {
12371249
"durationMs": 0
12381250
},
@@ -1459,6 +1471,13 @@
14591471
"styleSettings": {
14601472
"progressStyle": "loader"
14611473
}
1474+
},
1475+
{
1476+
"type": 1,
1477+
"content": {
1478+
"json": "---\r\nComputer drilldown v.1.3.0, built by **Edoardo Gerosa**"
1479+
},
1480+
"name": "text - 12"
14621481
}
14631482
],
14641483
"fromTemplateId": "sentinel-UserWorkbook",

‎hunting/workbooks/file_create_drilldown.json

+550-540
Large diffs are not rendered by default.

‎hunting/workbooks/functions/dns_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, process_path:string, query_name:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/file_access_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (technique_id:string, host:string, process_path:string, file_path:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/file_create_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, file_name:string, file_path:string, process_path:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/image_load_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, process_path:string, driver_loaded:string, driver_is_signed:string, driver_signature:string, driver_signature_status:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/network_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, user_name:string, process_path:string, src_ip:string, dst_ip:string, dst_port:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/pipe_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, process_path:string, pipe_name:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/process_access_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, process_path:string, target_process_path:string, process_granted_access:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/process_create_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, user:string, process_parent_path:string, process_path:string, process_command_line:string, hash_sha256:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/registry_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, event_type:string, process_path:string, registry_key_path:string, registry_key_details:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/functions/remote_thread_whitelist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
externaldata (host:string, event_type:string, process_path:string, target_process_path:string, target_process_address:string, reason:string) [h"{your_sas_token}"] with (ignoreFirstRecord=true)

‎hunting/workbooks/network_connection_drilldown.json

+402-391
Large diffs are not rendered by default.

‎hunting/workbooks/pipe_name_drilldown.json

+422-411
Large diffs are not rendered by default.

‎hunting/workbooks/process_guid_drilldown.json

+1,500-1,509
Large diffs are not rendered by default.

‎hunting/workbooks/trigger_overview.json

+276-295
Large diffs are not rendered by default.

‎hunting/workbooks/user_drilldown.json

+21-12
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
{
55
"type": 1,
66
"content": {
7-
"json": "## User drilldown workbook\n---\n"
7+
"json": "## User drilldown workbook\n---\n**Note:** All data in this workbook excludes whitelisted events."
88
},
99
"name": "text - 2"
1010
},
@@ -22,7 +22,7 @@
2222
"description": "Selects time range of the drilldown",
2323
"isRequired": true,
2424
"value": {
25-
"durationMs": 2419200000
25+
"durationMs": 172800000
2626
},
2727
"typeSettings": {
2828
"selectableValues": [
@@ -105,7 +105,7 @@
105105
"type": 3,
106106
"content": {
107107
"version": "KqlItem/1.0",
108-
"query": "Sysmon\n| where UserName contains @\"{user_name_value}\"\n| where isnotempty(technique_name)\n| summarize count() by technique_name, bin(TimeGenerated, 1h)",
108+
"query": "let process_path_create_whitelist = process_create_whitelist | project process_path;\nlet process_path_access_whitelist = process_access_whitelist | project process_path;\nlet process_path_dns_whitelist = dns_whitelist | project process_path;\nlet process_path_file_create_whitelist = file_create_whitelist | project process_path;\nlet process_path_image_load_whitelist = image_load_whitelist | project process_path;\nlet process_path_network_whitelist = network_whitelist | project process_path;\nlet process_path_pipe_whitelist = pipe_whitelist | project process_path;\nlet process_path_registry_whitelist = registry_whitelist | project process_path;\nSysmon\n| where UserName contains @\"{user_name_value}\"\n| where isnotempty(technique_name)\n| where process_path !in~ (process_path_create_whitelist) and process_path !in~ (process_path_access_whitelist) and process_path !in~ (process_path_dns_whitelist) and process_path !in~ (process_path_file_create_whitelist) and process_path !in~ (process_path_image_load_whitelist) and process_path !in~ (process_path_network_whitelist) and process_path !in~ (process_path_pipe_whitelist) and process_path !in~ (process_path_registry_whitelist)\n| summarize count() by technique_name, bin(TimeGenerated, 1h)",
109109
"size": 1,
110110
"showAnalytics": true,
111111
"title": "User activity by technique",
@@ -127,7 +127,7 @@
127127
"type": 3,
128128
"content": {
129129
"version": "KqlItem/1.0",
130-
"query": "Sysmon\r\n| where isnotempty(technique_name)\r\n| summarize c=count() by Computer, UserName\r\n| sort by c desc\r\n| project Computer, UserName, c",
130+
"query": "let process_path_create_whitelist = process_create_whitelist | project process_path;\r\nlet process_path_access_whitelist = process_access_whitelist | project process_path;\r\nlet process_path_dns_whitelist = dns_whitelist | project process_path;\r\nlet process_path_file_create_whitelist = file_create_whitelist | project process_path;\r\nlet process_path_image_load_whitelist = image_load_whitelist | project process_path;\r\nlet process_path_network_whitelist = network_whitelist | project process_path;\r\nlet process_path_pipe_whitelist = pipe_whitelist | project process_path;\r\nlet process_path_registry_whitelist = registry_whitelist | project process_path;\r\nSysmon\r\n| where isnotempty(technique_name)\r\n| where process_path !in~ (process_path_create_whitelist) and process_path !in~ (process_path_access_whitelist) and process_path !in~ (process_path_dns_whitelist) and process_path !in~ (process_path_file_create_whitelist) and process_path !in~ (process_path_image_load_whitelist) and process_path !in~ (process_path_network_whitelist) and process_path !in~ (process_path_pipe_whitelist) and process_path !in~ (process_path_registry_whitelist)\r\n| summarize c=count() by Computer, UserName\r\n| sort by c desc\r\n| project Computer, UserName, c",
131131
"size": 0,
132132
"showAnalytics": true,
133133
"title": "User activity by host",
@@ -623,7 +623,7 @@
623623
"type": 3,
624624
"content": {
625625
"version": "KqlItem/1.0",
626-
"query": "Sysmon\r\n| where RenderedDescription contains \"Process create\" and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, UserName, process_parent_path, process_path, file_name, process_parent_command_line, process_command_line, process_parent_guid, process_guid, hash_sha256, process_id, process_parent_id",
626+
"query": "let process_ppath_whitelist = process_create_whitelist | project process_parent_path;\r\nlet process_path_whitelist = process_create_whitelist | project process_path;\r\nlet command_line_whitelist = process_create_whitelist | project replace(\"'\", \"\", replace('\"', '', process_command_line));\r\nlet hash_whitelist = process_create_whitelist | project hash_sha256;\r\nSysmon\r\n| where RenderedDescription contains \"Process create\" and UserName == @\"{user_name_value}\"\r\n| where process_parent_path !in~ (process_ppath_whitelist) and process_path !in~ (process_path_whitelist) and replace('\"', '', tostring(process_command_line)) !in~ (command_line_whitelist) and hash_sha256 !in~ (hash_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, UserName, process_parent_path, process_path, file_name, process_parent_command_line, process_command_line, process_parent_guid, process_guid, hash_sha256, process_id, process_parent_id",
627627
"size": 0,
628628
"showAnalytics": true,
629629
"title": "Process Create",
@@ -827,7 +827,7 @@
827827
"type": 3,
828828
"content": {
829829
"version": "KqlItem/1.0",
830-
"query": "Sysmon\r\n| where RenderedDescription contains \"Process access\" and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, target_process_path, process_granted_access, target_process_guid, process_id, target_process_id",
830+
"query": "let process_path_whitelist = process_access_whitelist | project process_path;\r\nlet target_process_path_whitelist = process_access_whitelist | project target_process_path;\r\nlet process_granted_access_whitelist = process_access_whitelist | project process_granted_access;\r\nSysmon\r\n| where RenderedDescription contains \"Process access\" and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (process_path_whitelist) and target_process_path !in~ (target_process_path_whitelist) and process_granted_access !in~ (process_granted_access_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, target_process_path, process_granted_access, target_process_guid, process_id, target_process_id",
831831
"size": 0,
832832
"showAnalytics": true,
833833
"title": "Process Access",
@@ -976,7 +976,7 @@
976976
"type": 3,
977977
"content": {
978978
"version": "KqlItem/1.0",
979-
"query": "Sysmon\r\n| where RenderedDescription contains \"File create\" and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, file_name, process_guid, process_id",
979+
"query": "let file_name_whitelist = file_create_whitelist | project file_name;\r\nlet file_path_whitelist = file_create_whitelist | project file_path;\r\nlet proc_path_whitelist = file_create_whitelist | project process_path;\r\nSysmon\r\n| where RenderedDescription contains \"File create\" and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (proc_path_whitelist) and file_name !in~ (file_name_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, file_name, process_guid, process_id",
980980
"size": 0,
981981
"showAnalytics": true,
982982
"title": "File Created",
@@ -1103,7 +1103,7 @@
11031103
"type": 3,
11041104
"content": {
11051105
"version": "KqlItem/1.0",
1106-
"query": "Sysmon\r\n| where RenderedDescription contains \"Image loaded\" and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, UserName, process_path, module_loaded, module_is_signed, module_signature, module_signature_status, process_id, process_guid",
1106+
"query": "let process_path__whitelist = image_load_whitelist | project process_path;\r\nlet driver_loaded_whitelist = image_load_whitelist | project driver_loaded;\r\nlet driver_signed_whitelist = image_load_whitelist | project driver_is_signed;\r\nlet drv_signature_whitelist = image_load_whitelist | project driver_signature;\r\nlet signat_status_whitelist = image_load_whitelist | project driver_signature_status;\r\nSysmon\r\n| where RenderedDescription contains \"Image loaded\" and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (process_path__whitelist) and module_loaded !in~ (driver_loaded_whitelist) and module_is_signed !in~ (driver_signed_whitelist) and module_signature !in~ (drv_signature_whitelist) and module_signature_status !in~ (signat_status_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, UserName, process_path, module_loaded, module_is_signed, module_signature, module_signature_status, process_id, process_guid",
11071107
"size": 0,
11081108
"showAnalytics": true,
11091109
"title": "Image Loaded",
@@ -1274,7 +1274,7 @@
12741274
"type": 3,
12751275
"content": {
12761276
"version": "KqlItem/1.0",
1277-
"query": "Sysmon\r\n| where RenderedDescription contains \"Network connect\" and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, UserName, process_path, process_id, process_guid, src_ip, dst_ip, dst_port, src_host_name, dst_host_name",
1277+
"query": "let process_path_whitelist = network_whitelist | project process_path;\r\nlet src_ip_whitelist = network_whitelist | project src_ip;\r\nlet dst_ip_whitelist = network_whitelist | project dst_ip;\r\nlet dst_port_whitelist = network_whitelist | project dst_port;\r\nSysmon\r\n| where RenderedDescription contains \"Network connect\" and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (process_path_whitelist) and src_ip !in~ (src_ip_whitelist) and dst_ip !in~ (dst_ip_whitelist) and dst_port !in~ (dst_port_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, UserName, process_path, process_id, process_guid, src_ip, dst_ip, dst_port, src_host_name, dst_host_name",
12781278
"size": 0,
12791279
"showAnalytics": true,
12801280
"title": "Network Connection",
@@ -1455,10 +1455,11 @@
14551455
"type": 3,
14561456
"content": {
14571457
"version": "KqlItem/1.0",
1458-
"query": "Sysmon\r\n| where EventID == 8 and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, target_process_path, thread_new_id, process_guid, process_parent_guid",
1458+
"query": "let process_path_whitelist = remote_thread_whitelist | project process_path;\r\nlet target_process_path_whitelist = remote_thread_whitelist | project target_process_path;\r\nSysmon\r\n| where EventID == 8 and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (process_path_whitelist) and target_process_path !in~ (target_process_path_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, target_process_path, thread_new_id, process_guid, process_parent_guid",
14591459
"size": 0,
14601460
"showAnalytics": true,
14611461
"title": "Create Remote Thread",
1462+
"noDataMessage": "No create remote thread events for selected time generated",
14621463
"timeContext": {
14631464
"durationMs": 0
14641465
},
@@ -1476,7 +1477,7 @@
14761477
"type": 3,
14771478
"content": {
14781479
"version": "KqlItem/1.0",
1479-
"query": "Sysmon\r\n| where EventID == 12 and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, process_id, process_guid, registry_key_path",
1480+
"query": "let event_type_whitelist = registry_whitelist | project event_type;\r\nlet process_path_whitelist = registry_whitelist | project process_path;\r\nlet registry_key_path_whitelist = registry_whitelist | project registry_key_path;\r\nSysmon\r\n| where EventID == 12 and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (process_path_whitelist) and EventType !in~ (event_type_whitelist) and registry_key_path !in~ (registry_key_path_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, process_path, process_id, process_guid, registry_key_path",
14801481
"size": 0,
14811482
"showAnalytics": true,
14821483
"title": "Registry Access",
@@ -1603,10 +1604,11 @@
16031604
"type": 3,
16041605
"content": {
16051606
"version": "KqlItem/1.0",
1606-
"query": "Sysmon\r\n| where EventID == 17 and EventID==18 and UserName == @\"{user_name_value}\"\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, pipe_name, process_path, process_guid, process_id",
1607+
"query": "let process_path_whitelist = pipe_whitelist | project process_path;\r\nlet pipe_name_whitelist = pipe_whitelist | project pipe_name;\r\nSysmon\r\n| where (EventID == 17 or EventID==18) and UserName == @\"{user_name_value}\"\r\n| where process_path !in~ (process_path_whitelist) and pipe_name !in~ (pipe_name_whitelist)\r\n| project TimeGenerated, technique_id, technique_name, phase_name, Computer, pipe_name, process_path, process_guid, process_id",
16071608
"size": 0,
16081609
"showAnalytics": true,
16091610
"title": "Pipes",
1611+
"noDataMessage": "No pipe create and connect events for selected time and user",
16101612
"timeContext": {
16111613
"durationMs": 0
16121614
},
@@ -1619,6 +1621,13 @@
16191621
"styleSettings": {
16201622
"progressStyle": "loader"
16211623
}
1624+
},
1625+
{
1626+
"type": 1,
1627+
"content": {
1628+
"json": "---\r\nUser drilldown v.1.3.0, built by **Edoardo Gerosa**"
1629+
},
1630+
"name": "text - 26"
16221631
}
16231632
],
16241633
"fromTemplateId": "sentinel-UserWorkbook",

‎lab/files/dns_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,process_path,query_name,reason
2+
,,,

‎lab/files/file_access_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
technique_id,host,process_path,file_path,reason
2+
,,,,

‎lab/files/file_create_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,file_path,process_path,reason
2+
,,,,

‎lab/files/image_load_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,process_path,driver_loaded,driver_is_signed,driver_signature,driver_signature_status,reason
2+
,,,,,,

‎lab/files/network_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,user_name,process_path,src_ip,dst_ip,dst_port,reason
2+
,,,,,,

‎lab/files/pipe_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,process_path,pipe_name,reason
2+
,,,

‎lab/files/process_access_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,process_path,target_process_path,process_granted_access,reason
2+
,,,,

‎lab/files/process_create_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,user,process_parent_path,process_path,process_command_line,hash_sha256,reason
2+
,,,,,,

‎lab/files/registry_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,event_type,process_path,registry_key_path,reason
2+
,,,,

‎lab/files/remote_thread_whitelist.csv

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host,event_type,process_path,target_process_path,target_process_address,reason
2+
,,,,,

‎lab/main.tf

+113-4
Original file line numberDiff line numberDiff line change
@@ -149,9 +149,9 @@ resource "azurerm_storage_account" "storageaccount" {
149149
depends_on = [azurerm_subnet.subnet]
150150
}
151151

152-
# Create blob storage container
152+
# Create blob storage container for post configuration files
153153
resource "azurerm_storage_container" "blobstorage" {
154-
name = "${var.prefix}-cont"
154+
name = "${var.prefix}-store1"
155155
storage_account_name = azurerm_storage_account.storageaccount.name
156156
container_access_type = "blob"
157157
depends_on = [azurerm_storage_account.storageaccount]
@@ -169,22 +169,131 @@ resource "azurerm_storage_blob" "utilsblob" {
169169

170170
# Create storage blob for create-ad.ps1 file
171171
resource "azurerm_storage_blob" "adblob" {
172-
depends_on = [azurerm_storage_container.blobstorage]
172+
depends_on = [azurerm_storage_blob.utilsblob]
173173
name = "create-ad.ps1"
174174
storage_account_name = azurerm_storage_account.storageaccount.name
175175
storage_container_name = azurerm_storage_container.blobstorage.name
176176
type = "block"
177177
source = "./files/create-ad.ps1"
178178
}
179179

180+
# Create blob storage container for whitelisting files
181+
resource "azurerm_storage_container" "whiteliststorage" {
182+
name = "${var.prefix}-store2"
183+
storage_account_name = azurerm_storage_account.storageaccount.name
184+
container_access_type = "private"
185+
depends_on = [azurerm_storage_blob.adblob]
186+
}
187+
188+
# Create storage blob for process create whitelist file
189+
resource "azurerm_storage_blob" "pcwhitelist" {
190+
depends_on = [azurerm_storage_container.whiteliststorage]
191+
name = "process_create_whitelist.csv"
192+
storage_account_name = azurerm_storage_account.storageaccount.name
193+
storage_container_name = azurerm_storage_container.whiteliststorage.name
194+
type = "block"
195+
source = "./files/process_create_whitelist.csv"
196+
}
197+
198+
# Create storage blob for dns whitelist file
199+
resource "azurerm_storage_blob" "dnswhitelist" {
200+
depends_on = [azurerm_storage_blob.pcwhitelist]
201+
name = "dns_whitelist.csv"
202+
storage_account_name = azurerm_storage_account.storageaccount.name
203+
storage_container_name = azurerm_storage_container.whiteliststorage.name
204+
type = "block"
205+
source = "./files/dns_whitelist.csv"
206+
}
207+
208+
# Create storage blob for file access whitelist file
209+
resource "azurerm_storage_blob" "fawhitelist" {
210+
depends_on = [azurerm_storage_blob.dnswhitelist]
211+
name = "file_access_whitelist.csv"
212+
storage_account_name = azurerm_storage_account.storageaccount.name
213+
storage_container_name = azurerm_storage_container.whiteliststorage.name
214+
type = "block"
215+
source = "./files/file_access_whitelist.csv"
216+
}
217+
218+
# Create storage blob for file create whitelist file
219+
resource "azurerm_storage_blob" "fcwhitelist" {
220+
depends_on = [azurerm_storage_blob.fawhitelist]
221+
name = "file_create_whitelist.csv"
222+
storage_account_name = azurerm_storage_account.storageaccount.name
223+
storage_container_name = azurerm_storage_container.whiteliststorage.name
224+
type = "block"
225+
source = "./files/file_create_whitelist.csv"
226+
}
227+
228+
229+
# Create storage blob for image load whitelist file
230+
resource "azurerm_storage_blob" "ilwhitelist" {
231+
depends_on = [azurerm_storage_blob.fcwhitelist]
232+
name = "image_load_whitelist.csv"
233+
storage_account_name = azurerm_storage_account.storageaccount.name
234+
storage_container_name = azurerm_storage_container.whiteliststorage.name
235+
type = "block"
236+
source = "./files/image_load_whitelist.csv"
237+
}
238+
239+
# Create storage blob for network whitelist file
240+
resource "azurerm_storage_blob" "netwhitelist" {
241+
depends_on = [azurerm_storage_blob.ilwhitelist]
242+
name = "network_whitelist.csv"
243+
storage_account_name = azurerm_storage_account.storageaccount.name
244+
storage_container_name = azurerm_storage_container.whiteliststorage.name
245+
type = "block"
246+
source = "./files/network_whitelist.csv"
247+
}
248+
249+
# Create storage blob for pipe whitelist file
250+
resource "azurerm_storage_blob" "pipewhitelist" {
251+
depends_on = [azurerm_storage_blob.netwhitelist]
252+
name = "pipe_whitelist.csv"
253+
storage_account_name = azurerm_storage_account.storageaccount.name
254+
storage_container_name = azurerm_storage_container.whiteliststorage.name
255+
type = "block"
256+
source = "./files/pipe_whitelist.csv"
257+
}
258+
259+
# Create storage blob for process access whitelist file
260+
resource "azurerm_storage_blob" "pawhitelist" {
261+
depends_on = [azurerm_storage_blob.pipewhitelist]
262+
name = "process_access_whitelist.csv"
263+
storage_account_name = azurerm_storage_account.storageaccount.name
264+
storage_container_name = azurerm_storage_container.whiteliststorage.name
265+
type = "block"
266+
source = "./files/process_access_whitelist.csv"
267+
}
268+
269+
# Create storage blob for registry whitelist file
270+
resource "azurerm_storage_blob" "regwhitelist" {
271+
depends_on = [azurerm_storage_blob.pawhitelist]
272+
name = "registry_whitelist.csv"
273+
storage_account_name = azurerm_storage_account.storageaccount.name
274+
storage_container_name = azurerm_storage_container.whiteliststorage.name
275+
type = "block"
276+
source = "./files/registry_whitelist.csv"
277+
}
278+
279+
# Create storage blob for remote thread whitelist file
280+
resource "azurerm_storage_blob" "rtwhitelist" {
281+
depends_on = [azurerm_storage_blob.pawhitelist]
282+
name = "remote_thread_whitelist.csv"
283+
storage_account_name = azurerm_storage_account.storageaccount.name
284+
storage_container_name = azurerm_storage_container.whiteliststorage.name
285+
type = "block"
286+
source = "./files/remote_thread_whitelist.csv"
287+
}
288+
180289
# Create public ip for domain controller 1
181290
resource "azurerm_public_ip" "dc1_publicip" {
182291
name = "${var.workstations.dc1}-external"
183292
location = var.location
184293
resource_group_name = azurerm_resource_group.rg.name
185294
allocation_method = "Dynamic"
186295
tags = var.tags
187-
depends_on = [azurerm_storage_blob.utilsblob]
296+
depends_on = [azurerm_storage_blob.rtwhitelist]
188297
}
189298

190299
# Create network interface for domain controller 1

0 commit comments

Comments
 (0)
Please sign in to comment.