Detection rules › Splunk
Multiple Host logons
Use case looks for users who have logged into multiple hosts
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
References
Telemetry coverage
Rule body
id: '5697.8028'
title: Multiple Host logons
description: 'Use case looks for users who have logged into multiple hosts. -- Threat
Actor Association: CL-STA-0043'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type IN(user_auth, user_login)
op IN(success, login) NOT TERM(failed) | eval user=coalesce(acct, user, id), src_ip=coalesce(addr,
hostname) | table _time, host, user, process, process_*, parent_*, src_ip, addr,
hostname, acct, id, res | bin span=86400s | stats values(*) as * by _time, user
| eventstats dc(host) as dc_host by user, _time | where dc_host > 1 '
techniques:
- defense-evasion:valid accounts
technique_id:
- T1078
data_category:
- Linux audit logs
references:
- https://www.cadosecurity.com/post/responding-to-solarigate
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_unix` type IN(user_auth, user_login) op IN(success, login) NOT TERM(failed)
Stage 2: eval
| eval user=coalesce(acct, user, id), src_ip=coalesce(addr, hostname)
Stage 3: table
| table _time, host, user, process, process_*, parent_*, src_ip, addr, hostname, acct, id, res
Stage 4: bucket
| bin span=86400s
Stage 5: stats
| stats values(*) as * by _time, user
Stage 6: eventstats
| eventstats dc(host) as dc_host by user, _time
Stage 7: where
| where dc_host > 1
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
dc_host | gt |
| field:"dc_host" kind:gt value:"1" |
op | in |
| field:"op" kind:in |
type | in |
| field:"type" kind:in |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | failed |