Large Security Operations Centers (SOCs) with multiple teams need help to make fast decisions when overwhelmed with security events.  A few short weeks ago in our Splunk Enterprise Security 7.2 release, we introduced optional enhancements to the Incident Review Dashboard that provide a more customizable experience when investigating notable events. This allows analysts to customize and configure the Incident Review Dashboard with table filters and columns to help isolate and rapidly investigate events that matter to them. Additionally, analysts can create saved views of their customized Incident Review Dashboard and share them with other Enterprise Security analysts. Saved Views allows analysts with different use cases to share their tailored views of notable events with other incident investigators in order to collaborate on notable events seamlessly. Splunk Enterprise Security Administrators also have access to a new level of control over the analyst experience in Incident Review, including configuring default views for all users.  This refined analyst experience is now on by default in Splunk Enterprise Security 7.3! In order to ease customers into these new workflows, we’ve also launched an interactive, in-product onboarding experience that will guide users through these new features.  Splunk Ideas continues to be front and center in Splunk Enterprise Security Customer feedback continues to drive innovation and enhancements in Splunk Enterprise Security. In this release, we added Drill-Down Dashboards to Incident Review, allowing content engineers to drill-down into a Splunk dashboard directly from the incident workflow. Users can now create multiple drill-down dashboard links and then use them to investigate a specific notable event. This enables analysts to seamlessly access critical details during an investigation, while reducing manual workloads. Content engineers can now customize the text of the drill-down link and also configure the fields that will be passed as tokens to the dashboard. The use cases for custom dashboards are endless with this new flexibility, and we can’t wait to see how the world’s most advanced SOCs leverage it.  Additionally, customers tell us that there are rare instances outside their control where data is not forwarded to Splunk in real-time, but that they still want Enterprise Security to check those data feeds for threats and anomalies. In this release, we’ve added Index Time Correlation Searches that allow administrators to run specific correlation rules on index time instead of event time for the data sources that routinely arrive after real-time. With this enhancement, Splunk continues to ensure complete visibility no matter where, or when, the data originates.   Risk-Based Alerting is now even more powerful Risk-Based Alerting is an innovative approach to help organizations prioritize security threats, aligned to the MITRE ATT&CK framework and an entity risk score. The SOC can reduce false positive investigations by up to 80% and speed the time needed to investigate and remediate true positive incidents by 50%. In Splunk Enterprise Security 7.3, the Risk Event Timeline is updated to include Drill-down Searches, Drill-down Dashboards, and Contributing Events so that analysts can quickly gather contextual information about risk events as they respond to Risk Notables. With Splunk Enterprise Security 7.3 you’ll get to experience the following enhancements:  Drill-down Searches are a long standing feature of Splunk Enterprise Security’s Incident Review Dashboard. Recently in Splunk Enterprise Security 7.2, we added support for multiple Drill-down Searches so that content engineers can provide analysts with as many options as they need to gather additional information via pre-made searches. Now, all available Drill-down Searches are available in the Risk Event Timeline, when applicable.  The new Drill-down Dashboards, launched in this new release, now also appear in Risk Event Timeline in addition to the Incident Review dashboard, if applicable.  Contributing Events are now refined in Risk Event Timeline to show analysts the raw events associated with a Risk Event, regardless of the presence of drill-down searches or drill-down dashboards having been defined. This provides analysts with the opportunity to gather more information about Risk Events. Additionally, risk events generated by cloud-based streaming analytics, included with Splunk Enterprise Security for customers operating in Splunk Cloud, will also benefit from the Contributing Events refinement for Risk Event Timeline.  Upgrade today to Enterprise Security 7.3! Splunk Enterprise Security 7.3 updates are available now in both cloud and on-prem environments.  We’re listening! If you have ideas and requests, please submit them to Splunk Ideas. To learn more about Splunk Enterprise Security 7.3, check out the release notes. Happy Splunking! ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.15.0 and v4.16.0). With these releases, there are 20 new detections, 4 new analytic stories, 7 updated analytics, 2 updated behavioral analytics detections, 3 new behavioral analytics detections, 2 updated analytic stories, and  2 deprecated analytics now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: Malware story that groups 6 new analytics to help detect a new phishing-driven malware campaign distributing DarkGate malware, which utilizes stolen email threads to trick users into downloading malicious payloads via hyperlinks. A new zero-day vulnerability in SysAid On-Prem Software (CVE-2023-47246) that allows attackers to upload a WebShell and other payloads, gaining unauthorized access and control. A new analytic Risk Rule for Dev Sec Ops by Repository that detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated, to provide a comprehensive view of the risk landscape and helps to make informed decisions. Additionally, we released an updated Analytics Story, which groups 10 new analytics to help security operations teams identify the potential compromise of Azure Active Directory accounts. A critical security update, CVE-2023-4966, for the NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. This vulnerability, if exploited, can lead to unauthorized data disclosure and possibly session hijacking. Along with "PlugX RAT" or "Kaba" known as the "silent infiltrator," it's the go-to tool for sophisticated hackers with one goal in mind: espionage. Additionally, we updated three existing analytics to identify suspicious file creation in the root drive observed in NjRAT, and two vulnerabilities privilege escalation flaws in Atlassian Confluence. New Analytics (20) Azure AD Device Code Authentication Azure AD Tenant Wide Admin Consent Granted Azure AD Multiple AppIDs and UserAgents Authentication Spike Azure AD Block User Consent For Risky Apps Disabled Azure AD User Consent Blocked for Risky Application Azure AD OAuth Application Consent Granted By User Azure AD User Consent Denied for OAuth Application Azure AD New MFA Method Registered Azure AD Multiple Denied MFA Requests For User Azure AD Multi-Source Failed Authentications Spike Risk Rule for Dev Sec Ops by Repository Windows ConHost with Headless Argument Windows CAB File on Disk Windows WinDBG Spawning AutoIt3 Windows MSIExec Spawn WinDBG Windows Modify Registry Default Icon Setting Windows AutoIt3 Execution Splunk App for Lookup File Editing RCE via User XSLT Splunk XSS in Highlighted JSON Events Citrix ADC and Gateway Unauthorized Data Disclosure New Analytic Stories (4)  DarkGate Malware SysAid On-Prem Software CVE-2023-47246 Vulnerability Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966 PlugX Updated Analytics (7) AWS ECR Container Scanning Findings High AWS ECR Container Scanning Findings Medium AWS ECR Container Scanning Findings Low Informational Unknown AWS ECR Container Upload Outside Business Hours  Windows Admin Permission Discovery Confluence CVE-2023-22515 Trigger Vulnerability Confluence Data Center and Server Privilege Escalation Updated Behavioral Analytics Detections (2) All BA detections updated to use IN command in SPLv2 instead of using multiple ORs in the detection analytic Added a new key detection_type = STREAMING in the generated BA yaml files New Behavioral Analytics Detections (3) Detect Prohibited Applications Spawning cmd exe browsers (validation) Detect Prohibited Applications Spawning cmd exe office (validation) Detect Prohibited Applications Spawning cmd exe powershell (validation) Updated Analytic Stories (2) Azure Active Directory Account Takeover Splunk Vulnerabilities Deprecated Analytics (2)     Correlation by Repository and Risk Correlation by User and Risk The team has also published the following blogs:  More Than Just a RAT: Unveiling NjRAT's MBR Wiping Capabilities For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team   ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.13.0, v4.14.0.). With these releases, there are 22 new detections and 6 new analytic stories, and 3 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: An analytic story for a previously unknown vulnerability in the Cisco IOS XE software's Web User Interface (Web UI) feature that is currently being exploited and effectively grants full control of the compromised device.  An analytic story focused on Windows SIP WinVerifyTrust subversion and an analytic story for Microsoft SharePoint Server to detect a flaw in handling authentication tokens, which allows an attacker to escalate privileges and gain unauthorized access to the SharePoint environment.  A NjRat analytic story that contains 7 detections to detect attack techniques relating to NjRat, a notorious remote access trojan (RAT). The detections include tracking file write operations for dropped files, scrutinizing registry modifications to provide persistence mechanisms, monitoring suspicious processes, self-deletion behaviors, browser credential parsing, firewall configuration alterations, spreading itself via removable drive, and other potentially malicious actions. Additionally, we released new analytics to address Splunk CVEs that focus on attacker behavior targeting Splunk environments, along with 2 new analytics for CVEs related to Remote Code Execution (RCE) in WS_FTP and TeamCity On-Premises.  New Analytics (22) Cisco IOS XE Implant Access Detect Certipy File Modifications (External Contributor: Steven Dick) Windows Domain Admin Impersonation Indicator Windows Registry SIP Provider Modification Microsoft SharePoint Server Elevation of Privilege Windows Steal Authentication Certificates - ESC1 Abuse (External Contributor: Steven Dick) Windows SIP Provider Inventory Windows SIP WinVerifyTrust Failed Trust Validation Confluence CVE-2023-22515 Trigger Vulnerability Windows Abused Web Services Windows Admin Permission Discovery JetBrains TeamCity RCE Attempt WS FTP Remote Code Execution Splunk Reflected XSS on App Search Table Endpoint Splunk RCE via Serialized Session Payload Splunk DoS Using Malformed SAML Request Splunk Absolute Path Traversal Using runshellscript Windows Modify Registry With MD5 Reg Key Name Windows Njrat Fileless Storage via Registry Windows Executable in Loaded Modules Windows Disable or Modify Tools Via Taskkill Windows Delete or Modify System Firewall New Analytic Stories (6) Subvert Trust Controls SIP and Trust Provider Hijacking Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 Cisco IOS XE Software Web Management User Interface vulnerability NjRat WS FTP Server Critical Vulnerabilities JetBrains TeamCity Unauthenticated RCE Updated Analytics (3) Citrix ADC Exploitation CVE-2023-3519 Windows Replication Through Removable Media TOR Traffic For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

In our latest release of Splunk Enterprise Security 7.2, we are excited to introduce capabilities that deliver an improved workflow experience for simplified investigations; enhanced visibility and reduced manual workload; and customized investigation workflows for faster decision-making. The majority of these updates and new features were requested directly from Splunk Enterprise Security (ES) users and submitted through the Splunk Ideas portal! Keep the great ideas and suggestions coming - we’re listening! With these new capabilities, ES helps you see more, act faster, and simplify your investigations.  Improved workflow experience for simplified investigations  Multiple Drill-down Searches on Correlation Rules: Users can now create multiple drill-down searches on correlation rules to quickly narrow their investigation stemming from a notable event.   Enhanced Risk Analysis Dashboard: With the enhanced risk analysis dashboard, security analysts have a deeper, more holistic layer of visibility across all detection events. The SOC can assess organizational risk faster from users and entities, and analysts can drill down on specific users and entities for additional context on risk contributions.  Dispositions in Incident Review: With ES 7.2, ES Administrators can require disposition when closing notables. This provides a feedback loop into detection engineering, allowing efficient review of security detections. Hyperlinks in Correlation Search “Next Steps”: This new capability enables ES administrators to include a link to resources such as wiki pages, runbooks, Splunk dashboards, or even third party websites, as part of an analysts’ response workflow. Analysts are able to view details as part of an event’s “Next Steps” which enhances and accelerates the analyst’s investigation process. Enhanced visibility and reduced manual workload With the new Auto Refresh in Incident Review, ES will automatically showcase the most up-to-date events for the SOC. Administrators can now customize and control the frequency of the auto refresh.  Security analysts can currently prioritize notable events within Splunk Enterprise Security, but often want to visualize it by date and time. That’s why we brought back the Timeline function in Incident Review. This interactive timeline for notables supports analysts by enabling the SOC to quickly gain insight into anomalous activity, such as an unusually high number of notables around a certain time, and therefore prioritize time-sensitive critical incidents.  Customize investigation workflows for faster decision-making ES 7.2 introduces optional enhancements to the Incident Review dashboard that provides a more customizable experience when investigating notable events. Analysts are now able to customize and configure the Incident Review dashboard with table filters and columns that provide the capability for practitioners to look at events that matter to them.  Additionally, they can now create saved views of their customized Incident Review Dashboard and share them with other Enterprise Security analysts.   Upgrade today to Splunk Enterprise Security 7.2!  Ready to get hands on with Enterprise Security 7.2? Register for our Tech Talk! If you have ideas and requests, please submit them to Splunk Ideas! ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the Enterprise Security Content Update (ESCU) app (v4.12.0.). With this release, there are 8 new detections and 1 new analytic story now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: A Forest Blizzard analytic story that contains detections to detect “Living Off The Land” attack techniques using headless web browsers to exfiltrate data files through legitimate platforms like Mockbin via ZIP archives containing LNK files. These techniques were observed in the cyberattack on Ukraine’s energy infrastructure, orchestrated via deceptive emails to steal NTLMv2 hashes by various advanced persistent threat (APT) groups. Six new detections related to Windows Active Directory enumeration, specifically to detect activity related to the usage of a popular red team tool such as Powerview, which are typically used for reconnaissance by attackers.  New Analytic Story:  Forest Blizzard New Detections: Windows Find Domain Organizational Units with GetDomainOU Headless Browser Usage Headless Browser Mockbin or Mocky Request Windows Get Local Admin with FindLocalAdminAccess Windows Forest Discovery with GetForestDomain Windows Find Interesting ACL with FindInterestingDomainAcl Windows AD Privileged Object Access Activity (External Contributor: Steven Dick) Windows AD Abnormal Object Access Activity (External Contributor: Steven Dick) The team has also published the following blogs: Sharing is Not Caring: Hunting for Network Share Discovery Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

In this release, we provide three new capabilities to help security teams detect suspicious behavior in real-time, quickly discover the scope of an incident to respond accurately, and improve security workflow efficiencies using embedded frameworks.  We've introduced cloud-based streaming analytics* cloud-based streaming analytics integrates with Splunk’s risk-based alerting (RBA) framework to deliver enhanced analytics for improved situational awareness and response time to suspicious behavior.  This feature brings scalable real-time streaming analytics for a broader range of advanced security detections and focuses on addressing common use cases including insider threat, credential access and compromise, lateral movement, and living off the land attacks. *Initial availability to eligible US-East Splunk Cloud customers only   Splunk Enterprise Security 7.1 also brings a new visualization feature, Threat Topology, which provides a comprehensive view into security incidents, enabling analysts to quickly determine the scope of security incidents, and achieve faster time to initiate an investigation. Last but not least, with our new MITRE ATT&CK® visualization security analysts can quickly build situational awareness around an incident in the context of the MITRE ATT&CK Matrix. Security analysts can leverage and visualize MITRE ATT&CK annotations in Splunk Enterprise Security risk events and get a comprehensive picture of how the asset or identity has been impacted by various tactics and techniques. So Why Wait? Upgrade today to Splunk Enterprise Security 7.1!      ... View more