Merge branch 'develop' of github.com:splunk/security_content into develop

2026-06-08 17:32:49 +00:00 · 2021-10-13 09:24:30 +02:00
parent eb02a97423 be69d68150
commit 0323ec0401
37 changed files with 47 additions and 12 deletions
@@ -44,6 +44,7 @@ tags:
    of $expected_upper_threshold$ with the following command $command$.
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - DE.DP
  - DE.CM
@@ -49,6 +49,7 @@ tags:
    command $command$.
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - DE.DP
  - DE.CM
@@ -46,6 +46,7 @@ tags:
    in their account
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - PR.DS
  - PR.AC
@@ -43,6 +43,7 @@ tags:
    from this IP $src$
  mitre_attack_id:
  - T1136.003
+  - T1136
  nist:
  - PR.DS
  - PR.AC
@@ -46,6 +46,7 @@ tags:
    and did a console login from this IP $src_ip$
  mitre_attack_id:
  - T1136.003
+  - T1136
  nist:
  - PR.DS
  - PR.AC
@@ -37,6 +37,7 @@ tags:
  message: Vulnerabilities with severity high found in image $image$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -36,6 +36,7 @@ tags:
  message: Vulnerabilities with severity high found in repository $repositoryName$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -35,6 +35,7 @@ tags:
  message: Vulnerabilities with severity high found in image $image$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -33,6 +33,7 @@ tags:
  message: Container uploaded outside business hours from $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -33,6 +33,7 @@ tags:
  message: Container uploaded from unknown user $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -42,6 +42,7 @@ tags:
  mitre_attack_id:
  - T1069.003
  - T1098
+  - T1069
  observable:
  - name: src
    type: IP Address
@@ -46,6 +46,7 @@ tags:
    CIDR $requestParameters.cidrBlock$
  mitre_attack_id:
  - T1562.007
+  - T1562
  nist:
  - DE.DP
  - DE.AE
@@ -41,6 +41,7 @@ tags:
    $eventName$), such that the instance is accessible from anywhere
  mitre_attack_id:
  - T1562.007
+  - T1562
  nist:
  - DE.DP
  - DE.AE
@@ -45,6 +45,7 @@ tags:
    event $eventName$ for updating the the default policy version
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - PR.DS
  - PR.AC
@@ -39,6 +39,7 @@ tags:
    user $user_arn$ more access privilleges
  mitre_attack_id:
  - T1136.003
+  - T1136
  nist:
  - PR.DS
  - PR.AC
@@ -44,6 +44,7 @@ tags:
  message: User $user$ is creating a new instance $dest$ for the first time
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - ID.AM
  observable:
@@ -44,6 +44,7 @@ tags:
  message: User $user$ is modifying an instance $dest$ for the first time.
  mitre_attack_id:
  - T1078.004
+  - T1078
  nist:
  - ID.AM
  observable:
@@ -27,6 +27,7 @@ tags:
  message: Correlation triggered for user $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -27,6 +27,7 @@ tags:
  message: Correlation triggered for user $user$
  mitre_attack_id:
  - T1204.003
+  - T1204
  nist:
  - PR.DS
  - PR.AC
@@ -23,7 +23,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 30
  context:
@@ -22,7 +22,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 30
  context:
@@ -33,6 +33,7 @@ tags:
  message: Vulnerabilities found in packages used by GitHub repository $repository$
  mitre_attack_id:
  - T1195.001
+  - T1195
  nist:
  - PR.DS
  - PR.AC
@@ -33,6 +33,7 @@ tags:
  message: Vulnerabilities found in packages used by GitHub repository $repository$
  mitre_attack_id:
  - T1195.001
+  - T1195
  nist:
  - PR.DS
  - PR.AC
@@ -19,14 +19,14 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
  | `gsuite_drive_share_in_external_email_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
+  extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 known_false_positives: network admin or normal user may share files to customer and
  external team.
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  confidence: 90
  context:
  - Source:Endpoint
@@ -41,11 +41,12 @@ tags:
  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
  mitre_attack_id:
  - T1567.002
+  - T1567
  observable:
  - name: parameters.owner
    type: User
    role:
-    - attacker
+    - Attacker
  - name: email
    type: User
    role:
@@ -66,3 +67,4 @@ tags:
  - parameters.doc_type
  risk_score: 72
  security_domain: endpoint
+
@@ -28,7 +28,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  confidence: 70
  context:
  - Source:Endpoint
@@ -41,6 +41,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1566.001
+  - T1566
  observable:
  - name: source.address
    type: User
@@ -35,7 +35,7 @@ references:
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -49,6 +49,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1566.001
+  - T1566
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -26,7 +26,7 @@ references:
 - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -40,6 +40,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1566.001
+  - T1566
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -27,7 +27,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  confidence: 30
  context:
  - Source:Endpoint
@@ -40,6 +40,7 @@ tags:
  message: suspicious email from $source.address$ to $destination{}.address$
  mitre_attack_id:
  - T1048.003
+  - T1048
  observable:
  - name: source.address
    type: User
@@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
  | `gsuite_suspicious_shared_file_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
+  extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 known_false_positives: normal user or normal transaction may contain the subject and
  file type attachment that this detection try to search
 references:
@@ -32,7 +32,7 @@ references:
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
  analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
  automated_detection_testing: passed
  confidence: 70
  context:
@@ -46,6 +46,7 @@ tags:
  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
  mitre_attack_id:
  - T1566.001
+  - T1566
  observable:
  - name: parameters.owner
    type: User
@@ -41,6 +41,7 @@ tags:
    Address $ActorIpAddress$
  mitre_attack_id:
  - T1136.003
+  - T1136
  observable:
  - name: ActorIpAddress
    type: IP Address
@@ -44,6 +44,7 @@ tags:
    service principal credentials from IP Address $ActorIpAddress$
  mitre_attack_id:
  - T1136.003
+  - T1136
  observable:
  - name: ActorIpAddress
    type: IP Address
@@ -45,6 +45,7 @@ tags:
    list of trusted IPs to bypass MFA
  mitre_attack_id:
  - T1562.007
+  - T1562
  observable:
  - name: ip_addresses_new_added
    type: IP Address
@@ -44,6 +44,7 @@ tags:
    $OrganizationName$
  mitre_attack_id:
  - T1136.003
+  - T1136
  observable:
  - name: OrganizationName
    type: Other
@@ -39,6 +39,7 @@ tags:
    the same destination $ForwardingAddress$
  mitre_attack_id:
  - T1114.003
+  - T1114
  nist:
  - DE.DP
  - DE.AE
@@ -38,6 +38,7 @@ tags:
    that allow access to sensitive
  mitre_attack_id:
  - T1114.002
+  - T1114
  nist:
  - DE.DP
  - DE.AE
@@ -39,6 +39,7 @@ tags:
    a forwarding rule to same destination $ForwardingSmtpAddress$
  mitre_attack_id:
  - T1114.003
+  - T1114
  nist:
  - DE.DP
  - DE.AE
@@ -14,7 +14,7 @@ narrative: DevSecOps is a collaborative framework, which thinks about applicatio
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
-  analytic_story: DevSecOps
+  analytic_story: Dev Sec Ops
  category:
  - Cloud Security
  product: