CROWDSTRIKE NEXT-GEN SIEM TASK

Custom CQL queries should be created according to the following scenarios:

• Failed Login: Write a CQL Query that displays in a table format all failed user logins over the past day, including timestamp, failed account, source IP, host, and other relevant information.
• New User Account Creations: Write a CQL Query that displays in a table format the new user accounts created over the past day, their creation time, host, the user who created them, and other relevant information.
• PowerShell Usage: Write a CQL Query that displays in a table format PowerShell execution events over the past day, including the executed command, execution time, the user who executed it, and whether -EncodedCommand was used.
• Potential Brute-Force: Write a CQL Query that displays in a table format the user, host/Computer, source IP, service (RDP/SSH), and other relevant information where 4 or more failed logins occurred from the same source or with the same user within the last 1 minute, followed by at least 1 successful login.
• SSH Lateral Movement: Same user logs in to multiple ($\ge 4$) Linux servers within 1 hour.

Preparation of detection rules (correlation rules) based on the queries above.

Creating a Fusion SOAR Workflow: Create custom Playbooks according to the following scenarios.

1. High Severity Detection: If the detection severity is Critical or High, the case should be assigned to you, and an alert email should be sent to you.
2. Workflow Execution: If the workflow execution fails, an email should be sent to you.
3. Ticketing: Detections generated based on the queries prepared in the first task should be sent to Jira as tickets (issues). The tickets should reflect Threat Intelligence (TI) / reputation data for the relevant fields.
4. Failed Login: Write a CQL Query that displays in a table format all failed user logins over the past day, including timestamp, failed account, source IP, host, and other relevant information.

2. New User Account Creations: Write a CQL Query that displays in a table format the new user accounts created over the past day, their creation time, host, the user who created them, and other relevant information.

3. PowerShell Usage: Write a CQL Query that displays in a table format PowerShell execution events over the past day, including the executed command, execution time, the user who executed it, and whether -EncodedCommand was used.

4. Potential Brute-Force: Write a CQL Query that displays in a table format the user, host/Computer, source IP, service (RDP/SSH), and other relevant information where 4 or more failed logins occurred from the same source or with the same user within the last 1 minute, followed by at least 1 successful login.

5. SSH Lateral Movement: Same user logs in to multiple (>=4) Linux servers within 1 hour

Creating a Fusion SOAR Workflow:

Create custom Playbooks according to the following scenarios. 1. High Severity Detection: If the detection severity is Critical or High, assign the case to you and send you an alert email.

“Result of the send mail function in the action:”

Workflow Execution: If workflow execution fails, an email should be sent to you.

Get Gardash Aliyev’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

“Result of the send mail function in the action:”

Ticketing:

Detections generated based on the queries prepared in the first task should be sent to Jira as tickets (issues). The tickets should reflect Threat Intelligence (TI) / reputation data for the relevant fields.

“A Jira Task Rule has been created using the query from the first task. The properties of this rule are as follows:”

“As a result, when an event created using the query from the first task matching this rule is found, a detection with (High) severity is created:”

This Workflow consists of 4 parts:

1. Trigger: The detection from NG-SIEM represents the 1st stage that triggers this workflow.
2. Condition: The condition section specifies the criteria required for the action section of the workflow to execute. If this condition is met, it proceeds to the Action section and executes the operations there.
3. VirusTotal IP Lookup: The section where an IP Lookup is performed via VirusTotal. It is used to display Threat Intelligence (TI) / Reputation information about the malicious IP.
4. Final Action: In the final Action, a Jira issue is created, and the specified field data is sent to Jira.

Ticket created by the workflow prepared in Falcon. Here, the attacker IP has been looked up, TI/Reputation data is included, and the relevant fields of the event are also displayed.

Combining 5 tasks with parallel conditions using a Jira Task Workflow:

1. Powershell Execution Rule

2) UserLogon Failed Rule

3) BruteForce Attack Rule

4) SSH Literal Movement Rule