In this blog post, I will test the WannaCry malware against almost all Windows Sigma detection rules from the subfolders builtin, process_creation and sysmon (a total of 192 detection rules). WannaCry was one of the biggest cyber attacks affecting over 200.000 computers in 150 countries. In order to run the malware in a secure way, […]
The Sigma repository contains over 200 Sigma detection rules. But we all know, quantity is not equal to quality. That’s why I started a new blog series, in which I will test real malware against a bunch of Sigma detection rules. In this blog post, I will test the TeslaCrypt malware against almost all Windows […]
Continuous Integration (CI) and Continuous Delivery (CD) is a well-known concept in software development. In this blog post, I will introduce the concept of CI/CD and adapt it to the IT Security world based on the example of detection rule development. Continuous Integration (CI) means that the main branch is continuously validated by creating a […]
This blog post is a tutorial about a newly created tool Sigma2SplunkAlert converter. Many Security Operations Center (SOC) are using scheduled searches for their detection rules. Sigma is the new standard for describing detection rules. Deploying multiple Sigma detection rules into Splunk was a time-consuming task. Sigma2SplunkAlert converts multiple Sigma detection rules into a Splunk […]
In this blog post, I will introduce a new Sigma Use Case detecting local user creation in an Active Directory (AD) environment. The creation of a new user creates a Windows Event Log of Type Security with the Event Code 4720. In an AD environment, only domain controller should create these Windows Event Logs. By […]
In this blog post, I will introduce another Sigma Use Case detecting Command & Control (C2) traffic over Domain Name System (DNS). DNS is used to translate human-friendly computer hostnames into IP addresses. The domain name www.test.com belongs to the top-level domain com. Each label to the left specifies a subdomain of the domain to […]
In this blog post, I will introduce a Sigma detection rule, which detects privilege escalation preparation in Linux. If an adversary has a limited shell and wants to escalate privileges, different information needs to be collected over the machine. This information includes the distribution type, kernel version, environment variables, running root services, applications, cron jobs […]
In this blog post, we will develop a Security Use Case with the generic signature description language Sigma and test it with Atomic Threats. Sigma is a generic signature format supporting multiple SIEM solutions and therefore make it sharable with the IT Security community. Furthermore, vendor lock-in is avoided using Sigma. A tutorial “How to […]
In this blog post, I will introduce the Splunk Deployment Server and give some best practice recommendations for apps and server class structure. I already see a lot of Splunk deployments with a terrible app and server class structure, which makes it very difficult to manage the Splunk infrastructure. Therefore, I decided to write this […]
In this blog post, I will cover some recommendations for monitor executed bash commands in Linux using Splunk. After reviewing and testing multiple solutions, I found one solution which do the job perfectly and is easy to configure. The solution is that we add a line in /etc/bashrc and then all the commands executed in […]