Detection rules › Splunk

Multiple Host logons

Group by
_time, user
Source
github.com/anvilogic-forge/armory

Use case looks for users who have logged into multiple hosts

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Persistence
Privilege Escalation
Stealth

References

Telemetry coverage

Rule body

id: '5697.8028'
title: Multiple Host logons
description: 'Use case looks for users who have logged into multiple hosts. -- Threat
  Actor Association: CL-STA-0043'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type IN(user_auth, user_login)
  op IN(success, login) NOT TERM(failed) | eval user=coalesce(acct, user, id), src_ip=coalesce(addr,
  hostname) | table _time, host, user, process, process_*, parent_*, src_ip, addr,
  hostname, acct, id, res | bin span=86400s | stats values(*) as * by _time, user
  | eventstats dc(host) as dc_host by user, _time | where dc_host > 1 '
techniques:
- defense-evasion:valid accounts
technique_id: 
- T1078
data_category:
- Linux audit logs
references:
- https://www.cadosecurity.com/post/responding-to-solarigate

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_unix` type IN(user_auth, user_login) op IN(success, login) NOT TERM(failed)

Stage 2: eval

| eval user=coalesce(acct, user, id), src_ip=coalesce(addr, hostname)

Stage 3: table

| table _time, host, user, process, process_*, parent_*, src_ip, addr, hostname, acct, id, res

Stage 4: bucket

| bin span=86400s

Stage 5: stats

| stats values(*) as * by _time, user

Stage 6: eventstats

| eventstats dc(host) as dc_host by user, _time

Stage 7: where

| where dc_host > 1

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
dc_hostgt
  • 1
field:"dc_host" kind:gt value:"1"
opin
  • login
  • success
field:"op" kind:in
typein
  • user_auth
  • user_login
field:"type" kind:in

Search terms

These SPL tokens match against raw event text.

StageTerm
1failed