Enterprise Security Content Update (ESCU) v3.51.0

[cwopat]

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v.3.51.0, which contains 9 new detections and 2 new analytic stories to help you stay ahead of threats. These detections are now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). 

Release highlights include: 

• Advisory analytic story to assist defenders with CISA AA22-277A, which was recently released by the Cybersecurity and Infrastructure Security Agency (CISA) in response to an advanced persistent threat (APT) that utilized Impacket, an open-source toolkit, and other common techniques. 
  
  
• Updated content based on feedback and simulated attack data related to ProxyNotShell, which is a continuation of the ProxyShell saga but requires valid credentials. 
  
  
• Additional content for the Cloud Account Takeover use case with four new analytics that help detect attacks against Multi-factor Authentication (MFA) defense mechanisms for Amazon Web Services (AWS) console.
  
  
• New detections: 
  • AWS Console Login Failed During MFA Challenge
  • AWS Multi-Factor Authentication Disabled
  • AWS Multiple Failed MFA Requests For User
  • AWS Successful Single-Factor Authentication
  • Detect Exchange Web Shell
  • ProxyShell ProxyNotShell Behavior Detected
  • Windows Create Local Account
  • Windows Exchange Autodiscover SSRF Abuse 
  • Windows Mshta Execution In Registry
    
    
• New Analytic Stories:
  • CISA AA22-277A
  • ProxyNotShell
    
    
• Updated Analytics:
  • Detect SharpHound File Modifications
  • Exchange PowerShell Abuse via SSRF
  • Exchange PowerShell Module UsageUnified Messaging Service Spawning a Process
    
    

For all our tools and security content, please visit research.splunk.com.

— The Splunk Threat Research Team