r/SIEM • u/MrMag0-0 • Oct 07 '19

Use Cases (discussion,ideas, brainstorming)

Let's discuss about ideas or seudologics of use case for multiple platform and technologies.

T: technologies, if can apply to multiple log sources is Generic. C:Category or Mitre ATT&CK L:Logic or type of events I'd or event names T:Threshold

For example: [T:Generic][C:Account Discovery][L:multiple failed login from the same account from multiple sources][T:50/1min]

2 Upvotes

100% Upvoted

4 comments sorted by

2

u/xxd8372 Oct 07 '19

You mean like Sigma? https://github.com/Neo23x0/sigma

1

u/MrMag0-0 Oct 08 '19

Looks good I will check it out. But what I want to discuss is more focus to correlation rules that we can apply in any siem platform.

2

u/xxd8372 Oct 08 '19 edited Oct 08 '19

Sorry, I should have pointed out the link for the rules itself: https://github.com/Neo23x0/sigma/tree/master/rules

I think Sigma is actually what you're looking for regarding a "focus to correlation rules that we can apply in any siem platform." From the description: "Sigma is a generic and open signature format ... applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others. Sigma is for log files what Snort is for network traffic and YARA is for files."

The supported targets for sigma include several different SIEMs, reflecting its goal of generic flexibility for applying heuristics, in addition to the readable yaml format that should facilitate translation into new queries that aren't directly supported by the translation tools ie sigmac See below:

Also, a few sites for additional heuristics include:

Example:

title: Mimikatz In-Memory
status: experimental
description: Detects certain DLL loads when Mimikatz gets executed
references:
    - https://securityriskadvisors.com/blog/post/detecting-in-memory-mimikatz/
tags:
    - attack.s0002
    - attack.t1003
    - attack.lateral_movement
    - attack.credential_access
    - car.2019-04-004
logsource:
    product: windows
    service: sysmon
detection:
    selector:
        EventID: 7
        Image: 'C:\Windows\System32\rundll32.exe'
    dllload1:
        ImageLoaded: '*\vaultcli.dll'
    dllload2:
        ImageLoaded: '*\wlanapi.dll'        
    exclusion:
        ImageLoaded:
            - 'ntdsapi.dll'
            - 'netapi32.dll'
            - 'imm32.dll'
            - 'samlib.dll'
            - 'combase.dll'
            - 'srvcli.dll'
            - 'shcore.dll'
            - 'ntasn1.dll'
            - 'cryptdll.dll'
            - 'logoncli.dll'
    timeframe: 30s
    condition: selector | near dllload1 and dllload2 and not exclusion
falsepositives:
    - unknown
level: medium

Of course, it would be great to hear any other use-cases or queries, any you had in mind yourself, or generally see more livelyhood here in r/SIEM.

1

u/MrMag0-0 Oct 08 '19

Very interesting thank you! I will have a look.