Splunk Security Content for Threat Detection & Response: June Recap
Security Splunk Threat Research TeamIn June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v5.7.0 and v5.8.0). With these releases, there are 16 new analytics and 3 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process.
Content highlights include:
- Remote Employment Fraud Detections: Remote Employment Fraud involves threat actors posing as job seekers or employers in order to gain unauthorized access to systems or employment through deceptive means. In many cases, it involves the use of fraudulent or stolen identity documents which are used to hide the true identity and/or location of an employee. We released a number of analytics that can help detect the digital footprint of employment fraud through the analysis of unexpected Network behaviors (such as VPN usage or anomalously high latency) or the presence of nonstandard audio or video devices.
- The MITRE ATT&CK Detection Coverage Overview is now live! This visualization shows the real-time detection coverage across all MITRE ATT&CK tactics and can be used to identify specific detections for a given Tactic.
- Inno Setup Abuse: Inno Setup is a widely used, legitimate packaging tool for the installation of software in Windows environments. It has seen increasingly common usage by malicious actors, hiding embedded malware payloads in otherwise benevolent software installers. These payloads, which are often encrypted or obfuscated, are then executed by a number of different means such as scripting or process injection. We released a story analytic story that demonstrates a number of different techniques observed by malware abusing Inno Setup to gain execution and persistence.
- Web Browser Abuse: Locally installed malware may use Web Browsers to aid in the execution of malicious code, perform command and control, or transfer files. To decrease their footprint or provide flexibility in how they operate, this malware may supply a number of nonstandard command line flags when launching browsers. We release a number of analytics which recognize these suspicious flags.
- Cisco Secure Firewall Threat Defense Integration: A number of ESCU Detections have been improved and tested to work with Event Streamer (eStreamer) data collected by the Cisco Secure Firewall Threat Defense (FTD) platform. For more information about Cisco Secure Firewall, please go here or refer to the Analytic Story Cisco Secure Firewall Threat Defense Analytics.
- Bugfixes based on Community Feedback: Feedback from community members and users continues to be one of the best paths to improve the quality and performance of ESCU content. We released a number of bug fixes that reduce false positives and improve the risk objects and fields returned from searches.
For all our tools and security content, please visit research.splunk.com.
Title
Related Articles
Filter
Category
Blog Limit
3
Category
security
Sort Category Shuffle Order
true
Related Articles
Staff Picks for Splunk Security Reading December 2020
These monthly postings will feature the favorite security-centric presentations, white papers and customer case studies from various peeps in the Splunk (or not) security world that WE think everyone should read. If you would like to read other months, please take a peek at previous posts in the "Staff Picks" series!
Identifying BOD 23-02 Network Management Interfaces with Splunk
Splunker Drew Church explains the CISA-released directive to reduce risk from internet-exposed management interfaces, highlighting the threat of external remote services.
Infostealer Campaign against ISPs
The Splunk Threat Research Team observed actors performing minimal intrusive operations to avoid detection, with the exception of artifacts created by accounts already compromised.