diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 0d15635152..71e463fbf9 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -44,6 +44,7 @@ tags: of $expected_upper_threshold$ with the following command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 2b216b747e..1228ec4926 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -49,6 +49,7 @@ tags: command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index eeda62b531..931bf81982 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -46,6 +46,7 @@ tags: in their account mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index ed140d24b7..5c2276390f 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -43,6 +43,7 @@ tags: from this IP $src$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index b537158602..5a203a77d8 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -46,6 +46,7 @@ tags: and did a console login from this IP $src_ip$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index e7eca8106c..9a9eeb3114 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -37,6 +37,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index f6c36e1a8a..2baabc0834 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -36,6 +36,7 @@ tags: message: Vulnerabilities with severity high found in repository $repositoryName$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index eda8bdae60..755368af77 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -35,6 +35,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 2d193b4d16..e64f1de95b 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded outside business hours from $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 0e15c5211e..82d4fd850e 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded from unknown user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 6efc567d1d..c39a47fc4d 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -42,6 +42,7 @@ tags: mitre_attack_id: - T1069.003 - T1098 + - T1069 observable: - name: src type: IP Address diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index a7059316a2..028c55621a 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -46,6 +46,7 @@ tags: CIDR $requestParameters.cidrBlock$ mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 55634ba086..5a09c419bf 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -41,6 +41,7 @@ tags: $eventName$), such that the instance is accessible from anywhere mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 546333f7e9..6f90e57391 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -45,6 +45,7 @@ tags: event $eventName$ for updating the the default policy version mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 2d6d80437e..0c7fd9c7b2 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -39,6 +39,7 @@ tags: user $user_arn$ more access privilleges mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index f70c6e911a..43c8ea2de0 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is creating a new instance $dest$ for the first time mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 185d54b516..f05c111905 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is modifying an instance $dest$ for the first time. mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 78763720ca..8cae1eaf2f 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 6cbb1f0832..220dcb76c1 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 8b6d910d1e..9475fcad55 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -23,7 +23,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index 85c5cf21f8..e069f8de60 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -22,7 +22,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 4294037188..0ac8b391b0 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 3f4235831b..82025ef1a6 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index b451a2c38f..cd17a1880e 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -19,14 +19,14 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner | `gsuite_drive_share_in_external_email_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: network admin or normal user may share files to customer and external team. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 90 context: - Source:Endpoint @@ -41,11 +41,12 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1567.002 + - T1567 observable: - name: parameters.owner type: User role: - - attacker + - Attacker - name: email type: User role: @@ -66,3 +67,4 @@ tags: - parameters.doc_type risk_score: 72 security_domain: endpoint + diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 664b291d70..9c9133fe0b 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -28,7 +28,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 70 context: - Source:Endpoint @@ -41,6 +41,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index be34394965..1472fa6c77 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -35,7 +35,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: @@ -49,6 +49,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index aaf6b6cf5f..bbfe333ea6 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -26,7 +26,7 @@ references: - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index d4e3964783..c8c2b596d6 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -27,7 +27,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 30 context: - Source:Endpoint @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1048.003 + - T1048 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 65c240346c..d55a4bab94 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit | `gsuite_suspicious_shared_file_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search references: @@ -32,7 +32,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 70 context: @@ -46,6 +46,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: parameters.owner type: User diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 577c75383a..731f801395 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -41,6 +41,7 @@ tags: Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index ea17167487..6bcfb6259b 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -44,6 +44,7 @@ tags: service principal credentials from IP Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 1fc40093a1..4a9a8ef9ea 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -45,6 +45,7 @@ tags: list of trusted IPs to bypass MFA mitre_attack_id: - T1562.007 + - T1562 observable: - name: ip_addresses_new_added type: IP Address diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 5984dfc60d..7a416e6f60 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -44,6 +44,7 @@ tags: $OrganizationName$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: OrganizationName type: Other diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 82746f0989..cbb85e57e6 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -39,6 +39,7 @@ tags: the same destination $ForwardingAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 06d05f296e..be8f002199 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -38,6 +38,7 @@ tags: that allow access to sensitive mitre_attack_id: - T1114.002 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 9a7276d8b6..7644ef34f2 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -39,6 +39,7 @@ tags: a forwarding rule to same destination $ForwardingSmtpAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml index e800aef9d9..b7008f38b2 100644 --- a/stories/dev_sec_ops.yml +++ b/stories/dev_sec_ops.yml @@ -14,7 +14,7 @@ narrative: DevSecOps is a collaborative framework, which thinks about applicatio references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: - analytic_story: DevSecOps + analytic_story: Dev Sec Ops category: - Cloud Security product: