admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-10-31 08:38:07 -07:00
committed by GitHub
parent f53c545308 bbb418b337
commit 022b208ac9
699 changed files with 702 additions and 706 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/7zip_commandline_to_smb_share_path.yml
+1 -1
View File
@@ -55,4 +55,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/access_lsass_memory_for_dump_creation.yml
+1 -1
View File
@@ -62,4 +62,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/account_discovery_with_net_app.yml
+1 -1
View File
@@ -74,4 +74,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/active_setup_registry_autostart.yml
+1 -1
View File
@@ -65,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/add_defaultuser_and_password_in_registry.yml
+1 -1
View File
@@ -57,4 +57,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/add_or_set_windows_defender_exclusion.yml
+1 -1
View File
@@ -75,4 +75,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+1 -1
View File
@@ -69,4 +69,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+1 -1
View File
@@ -65,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/allow_network_discovery_in_firewall.yml
+1 -1
View File
@@ -67,4 +67,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/allow_operation_with_consent_admin.yml
+1 -1
View File
@@ -64,4 +64,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/anomalous_usage_of_7zip.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/any_powershell_downloadfile.yml
+1 -1
View File
@@ -87,4 +87,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/any_powershell_downloadstring.yml
+1 -1
View File
@@ -87,4 +87,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/attacker_tools_on_endpoint.yml
+1 -1
View File
@@ -68,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+1 -1
View File
@@ -72,4 +72,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/attempt_to_stop_security_service.yml
+1 -1
View File
@@ -81,4 +81,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+1 -1
View File
@@ -80,7 +80,7 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
detections/endpoint/auto_admin_logon_registry_entry.yml
+1 -1
View File
@@ -58,4 +58,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/batch_file_write_to_system32.yml
+1 -1
View File
@@ -68,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+1 -1
View File
@@ -61,4 +61,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/bcdedit_failure_recovery_modification.yml
+1 -1
View File
@@ -69,5 +69,5 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
update_timestamp: true
detections/endpoint/bits_job_persistence.yml
+1 -1
View File
@@ -78,7 +78,7 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
detections/endpoint/bitsadmin_download_file.yml
+1 -1
View File
@@ -83,7 +83,7 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+1 -1
View File
@@ -82,4 +82,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/certutil_exe_certificate_extraction.yml
+1 -1
View File
@@ -76,4 +76,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/certutil_with_decode_argument.yml
+1 -1
View File
@@ -84,4 +84,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/change_default_file_association.yml
+1 -1
View File
@@ -65,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/change_to_safe_mode_with_network_config.yml
+1 -1
View File
@@ -61,4 +61,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/chcp_command_execution.yml
+1 -1
View File
@@ -66,4 +66,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/check_elevated_cmd_using_whoami.yml
+1 -1
View File
@@ -61,4 +61,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+1 -1
View File
@@ -76,4 +76,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/clop_common_exec_parameter.yml
+1 -1
View File
@@ -75,4 +75,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/cmd_carry_out_string_command_parameter.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/cmd_echo_pipe___escalation.yml
+1 -1
View File
@@ -80,4 +80,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+1 -1
View File
@@ -84,4 +84,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
+1 -1
View File
@@ -60,4 +60,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/cobalt_strike_named_pipes.yml
+1 -1
View File
@@ -71,4 +71,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/common_ransomware_extensions.yml
+1 -1
View File
@@ -54,4 +54,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/common_ransomware_notes.yml
+1 -1
View File
@@ -57,4 +57,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/connectwise_screenconnect_path_traversal.yml
+1 -1
View File
@@ -59,4 +59,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/conti_common_exec_parameter.yml
+1 -1
View File
@@ -74,4 +74,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/control_loading_from_world_writable_directory.yml
+1 -1
View File
@@ -81,4 +81,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/create_remote_thread_in_shell_application.yml
+1 -1
View File
@@ -62,4 +62,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/create_remote_thread_into_lsass.yml
+1 -1
View File
@@ -62,4 +62,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+1 -1
View File
@@ -58,4 +58,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/creation_of_shadow_copy.yml
+1 -1
View File
@@ -73,7 +73,7 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log
detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+1 -1
View File
@@ -70,4 +70,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+1 -1
View File
@@ -67,4 +67,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+1 -1
View File
@@ -67,4 +67,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/csc_net_on_the_fly_compilation.yml
+1 -1
View File
@@ -52,4 +52,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/deleting_of_net_users.yml
+1 -1
View File
@@ -76,4 +76,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/deleting_shadow_copies.yml
+1 -1
View File
@@ -83,4 +83,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_azurehound_command_line_arguments.yml
+1 -1
View File
@@ -83,4 +83,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_azurehound_file_modifications.yml
+1 -1
View File
@@ -69,4 +69,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_certify_command_line_arguments.yml
+1 -1
View File
@@ -70,5 +70,5 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
update_timestamp: true
detections/endpoint/detect_certipy_file_modifications.yml
+1 -1
View File
@@ -80,5 +80,5 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
update_timestamp: true
detections/endpoint/detect_credential_dumping_through_lsass_access.yml
+1 -1
View File
@@ -64,4 +64,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_critical_alerts_from_security_tools.yml
+3 -7
View File
@@ -9,12 +9,8 @@ data_source:
- Windows Defender Alerts
- MS365 Defender Incident Alerts
description: The following analytics is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src Alerts.user Alerts.id Alerts.vendor sourcetype
| `drop_dm_object_name("Alerts")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`'
how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. The risk_score field is used to calculate the risk score for the alerts and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework is dynamically created by the detection when this is triggered. These fields need not be set in the adaptive response actions.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`'
how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. The risk_score field is used to calculate the risk score for the alerts and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework is dynamically created by the detection when this is triggered. These fields need not be set in the adaptive response actions.
known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment.
references:
- https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/accessing-microsoft-defender-for-cloud-alerts-in-splunk-using/ba-p/938228
@@ -76,4 +72,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_incident_alerts.log
source: m365_defender_incident_alerts
sourcetype: ms365:defender:incident:alerts
sourcetype: ms365:defender:incident:alerts
detections/endpoint/detect_exchange_web_shell.yml
+1 -1
View File
@@ -72,4 +72,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_html_help_renamed.yml
+1 -1
View File
@@ -69,4 +69,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_html_help_spawn_child_process.yml
+1 -1
View File
@@ -81,4 +81,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_html_help_url_in_command_line.yml
+1 -1
View File
@@ -81,4 +81,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+1 -1
View File
@@ -77,4 +77,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_mshta_inline_hta_execution.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_mshta_renamed.yml
+1 -1
View File
@@ -68,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_mshta_url_in_command_line.yml
+1 -1
View File
@@ -78,4 +78,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+1 -1
View File
@@ -75,4 +75,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
+1 -1
View File
@@ -73,4 +73,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+1 -1
View File
@@ -68,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_psexec_with_accepteula_flag.yml
+1 -1
View File
@@ -86,4 +86,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rare_executables.yml
+1 -1
View File
@@ -54,4 +54,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rclone_command_line_usage.yml
+1 -1
View File
@@ -75,4 +75,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regasm_spawning_a_process.yml
+1 -1
View File
@@ -78,4 +78,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regasm_with_network_connection.yml
+1 -1
View File
@@ -70,4 +70,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regsvcs_spawning_a_process.yml
+1 -1
View File
@@ -75,4 +75,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regsvcs_with_network_connection.yml
+1 -1
View File
@@ -68,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+1 -1
View File
@@ -78,4 +78,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_regsvr32_application_control_bypass.yml
+1 -1
View File
@@ -82,4 +82,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_renamed_7_zip.yml
+1 -1
View File
@@ -66,4 +66,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_renamed_psexec.yml
+1 -1
View File
@@ -76,4 +76,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_renamed_rclone.yml
+1 -1
View File
@@ -68,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_renamed_winrar.yml
+1 -1
View File
@@ -67,4 +67,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rtlo_in_file_name.yml
+1 -1
View File
@@ -65,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rtlo_in_process.yml
+1 -1
View File
@@ -72,4 +72,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+1 -1
View File
@@ -80,4 +80,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+1 -1
View File
@@ -80,4 +80,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+1 -1
View File
@@ -80,4 +80,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_rundll32_inline_hta_execution.yml
+1 -1
View File
@@ -67,4 +67,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_sharphound_command_line_arguments.yml
+1 -1
View File
@@ -70,4 +70,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_sharphound_file_modifications.yml
+1 -1
View File
@@ -70,4 +70,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_sharphound_usage.yml
+1 -1
View File
@@ -73,4 +73,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+1 -1
View File
@@ -61,4 +61,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_webshell_exploit_behavior.yml
+1 -1
View File
@@ -79,4 +79,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/detect_wmi_event_subscription_persistence.yml
+1 -1
View File
@@ -56,4 +56,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/disable_amsi_through_registry.yml
+1 -1
View File
@@ -60,4 +60,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/disable_defender_antivirus_registry.yml
+1 -1
View File
@@ -63,4 +63,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+1 -1
View File
@@ -64,4 +64,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Some files were not shown because too many files have changed in this diff Show More