Skip to content

Latest commit

 

History

History
232 lines (176 loc) · 9.79 KB

README.md

File metadata and controls

232 lines (176 loc) · 9.79 KB
Raw

Splunk Attack Range ⚔️

Attack Range Log

Purpose 🛡

The Attack Range is a detection development platform, which solves three main challenges in detection engineering:

  • 1. The user is able to quickly build a small lab infrastructure as close as possible to a production environment.
  • 2. The Attack Range performs attack simulation using different engines such as Atomic Red Team or Caldera in order to generate real attack data.
  • 3. It integrates seamlessly into any Continuous Integration / Continuous Delivery (CI/CD) pipeline to automate the detection rule testing process.

Demo 📺

A short demo (< 3 min) which shows the basic functions of the attack range. It builds a testing environment using terraform, walks through the data collected by Splunk. Then attacks it using MITRE ATT&CK Technique T1003 and finally showcases how Splunk Security Content searches are used to detect the attack.

Attack Range Demo

Building 👷‍♂️

Attack Range can be built in three different ways:

  • cloud with terraform plus AWS or Azure.
  • locally with vagrant and virtualbox
  • serverless with terraform and AWS services

Installation 🏗

Using Docker

  1. docker pull splunk/attack_range
  2. docker run -it splunk/attack_range

AWS and Ubuntu 18.04

  1. source <(curl -s 'https://raw.githubusercontent.com/splunk/attack_range/develop/scripts/ubuntu_deploy.sh')
  2. aws configure
  3. python attack_range.py configure

AWS and MacOS

  1. /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/splunk/attack_range/develop/scripts/macos_deploy_aws.sh)" && cd attack_range && source venv/bin/activate
  2. aws configure
  3. python attack_range.py configure

Azure and MacOS

  1. /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/splunk/attack_range/develop/scripts/macos_deploy_azure.sh)" && cd attack_range && source venv/bin/activate
  2. az login
  3. python attack_range.py configure

Architecture 🏯

Logical Diagram

The virtualized deployment of Attack Range consists of:

  • Windows Domain Controller
  • Windows Server
  • Windows Workstation
  • A Kali Machine
  • Splunk Server
  • Phantom Server
  • Zeek Sensor

Which can be added/removed/configured using attack_range.conf. More machines such as Phantom, Linux server, Linux client, MacOS clients are currently under development.

An approximate cost estimate for running attack_range on AWS can be found here.

Logging

The following log sources are collected from the machines:

  • Windows Event Logs (index = win)
  • Sysmon Logs (index = win)
  • Powershell Logs (index = win)
  • Network Logs with Splunk Stream (index = main)
  • Attack Simulation Logs from Atomic Red Team and Caldera (index = attack)

Running 🏃‍♀️

Attack Range supports different actions:

  • Configuring Attack Range
  • Build Attack Range
  • Perform Attack Simulation
  • Test with Attack Range
  • Destroy Attack Range
  • Stop Attack Range
  • Resume Attack Range
  • Dump Log Data from Attack Range

Configure Attack Range

python attack_range.py configure

Build Attack Range

python attack_range.py build

Show Attack Range Infrastructure

python attack_range.py show

Perform Attack Simulation

python attack_range.py simulate -st T1003.001 -t ar-win-dc-default-username-33048

Test with Attack Range

python attack_range.py test -tf tests/T1003_001.yml, tests/T1003_002.yml

Destroy Attack Range

python attack_range.py destroy

Stop Attack Range

python attack_range.py stop

Resume Attack Range

python attack_range.py resume

Dump Log Data from Attack Range

python attack_range.py dump -dn data_dump

Replay Dumps into Attack Range Splunk Server

  • Replay previously saved dumps from Attack Range
python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]
  • default will dump all enabled dumps described in attack_data/dumps.yml
  • with optional argument --dump you can specify which dump to replay
python attack_range.py replay -dn data_dump --dump windows_sec_events

Features 💍

  • Splunk Server

    • Indexing of Microsoft Event Logs, PowerShell Logs, Sysmon Logs, DNS Logs, ...
    • Preconfigured with multiple TAs for field extractions
    • Out of the box Splunk detections with Enterprise Security Content Update (ESCU) App
    • Preinstalled Machine Learning Toolkit (MLTK)
    • pre-indexed BOTS datasets
    • Splunk UI available through port 8000 with user admin
    • ssh connection over configured ssh key

  • Splunk Enterprise Security

  • Splunk Phantom

  • Windows Domain Controller & Window Server & Windows 10 Client

    • Can be enabled, disabled and configured over attack_range.conf
    • Collecting of Microsoft Event Logs, PowerShell Logs, Sysmon Logs, DNS Logs, ...
    • Sysmon log collection with customizable Sysmon configuration
    • RDP connection over port 3389 with user Administrator

  • Atomic Red Team

    • Attack Simulation with Atomic Red Team
    • Will be automatically installed on target during first execution of simulate
    • Atomic Red Team already uses the new Mitre sub-techniques

  • Caldera

    • Adversary Emulation with Caldera
    • Installed on the Splunk Server and available over port 8888 with user admin
    • Preinstalled Caldera agents on windows machines

  • Kali Linux

    • Preconfigured Kali Linux machine for penetration testing
    • ssh connection over configured ssh key

Support 📞

Please use the GitHub issue tracker to submit bugs or request features.

If you have questions or need support, you can:

Contributing 🥰

We welcome feedback and contributions from the community! Please see our contribution guidelines for more information on how to get involved.

Author

Contributors