admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1716 from splunk/CARS_UPDATE_MITRE_ID_B1

Browse Source 
Cars update mitre id b1
This commit is contained in:
Bhavin Patel
2021-10-12 13:10:40 -07:00
committed by GitHub
parent 0be2434332 3b2cb3f2ee
commit 08d172d13b
34 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
of $expected_upper_threshold$ with the following command $command$.
mitre_attack_id:
- T1078.004
- T1078
nist:
- DE.DP
- DE.CM
detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+1
View File
@@ -49,6 +49,7 @@ tags:
command $command$.
mitre_attack_id:
- T1078.004
- T1078
nist:
- DE.DP
- DE.CM
detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+1
View File
@@ -46,6 +46,7 @@ tags:
in their account
mitre_attack_id:
- T1078.004
- T1078
nist:
- PR.DS
- PR.AC
detections/cloud/aws_createaccesskey.yml
+1
View File
@@ -43,6 +43,7 @@ tags:
from this IP $src$
mitre_attack_id:
- T1136.003
- T1136
nist:
- PR.DS
- PR.AC
detections/cloud/aws_createloginprofile.yml
+1
View File
@@ -46,6 +46,7 @@ tags:
and did a console login from this IP $src_ip$
mitre_attack_id:
- T1136.003
- T1136
nist:
- PR.DS
- PR.AC
detections/cloud/aws_ecr_container_scanning_findings_high.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
message: Vulnerabilities with severity high found in image $image$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+1
View File
@@ -36,6 +36,7 @@ tags:
message: Vulnerabilities with severity high found in repository $repositoryName$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+1
View File
@@ -35,6 +35,7 @@ tags:
message: Vulnerabilities with severity high found in image $image$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
message: Container uploaded outside business hours from $user$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/aws_ecr_container_upload_unknown_user.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
message: Container uploaded from unknown user $user$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/aws_iam_successful_group_deletion.yml
+1
View File
@@ -42,6 +42,7 @@ tags:
mitre_attack_id:
- T1069.003
- T1098
- T1069
observable:
- name: src
type: IP Address
detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+1
View File
@@ -46,6 +46,7 @@ tags:
CIDR $requestParameters.cidrBlock$
mitre_attack_id:
- T1562.007
- T1562
nist:
- DE.DP
- DE.AE
detections/cloud/aws_network_access_control_list_deleted.yml
+1
View File
@@ -41,6 +41,7 @@ tags:
$eventName$), such that the instance is accessible from anywhere
mitre_attack_id:
- T1562.007
- T1562
nist:
- DE.DP
- DE.AE
detections/cloud/aws_setdefaultpolicyversion.yml
+1
View File
@@ -45,6 +45,7 @@ tags:
event $eventName$ for updating the the default policy version
mitre_attack_id:
- T1078.004
- T1078
nist:
- PR.DS
- PR.AC
detections/cloud/aws_updateloginprofile.yml
+1
View File
@@ -39,6 +39,7 @@ tags:
user $user_arn$ more access privilleges
mitre_attack_id:
- T1136.003
- T1136
nist:
- PR.DS
- PR.AC
detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
message: User $user$ is creating a new instance $dest$ for the first time
mitre_attack_id:
- T1078.004
- T1078
nist:
- ID.AM
observable:
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
message: User $user$ is modifying an instance $dest$ for the first time.
mitre_attack_id:
- T1078.004
- T1078
nist:
- ID.AM
observable:
detections/cloud/correlation_by_repository_and_risk.yml
+1
View File
@@ -27,6 +27,7 @@ tags:
message: Correlation triggered for user $user$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/correlation_by_user_and_risk.yml
+1
View File
@@ -27,6 +27,7 @@ tags:
message: Correlation triggered for user $user$
mitre_attack_id:
- T1204.003
- T1204
nist:
- PR.DS
- PR.AC
detections/cloud/github_dependabot_alert.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
message: Vulnerabilities found in packages used by GitHub repository $repository$
mitre_attack_id:
- T1195.001
- T1195
nist:
- PR.DS
- PR.AC
detections/cloud/github_pull_request_from_unknown_user.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
message: Vulnerabilities found in packages used by GitHub repository $repository$
mitre_attack_id:
- T1195.001
- T1195
nist:
- PR.DS
- PR.AC
detections/cloud/gsuite_drive_share_in_external_email.yml
+2
View File
@@ -41,6 +41,7 @@ tags:
message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
mitre_attack_id:
- T1567.002
- T1567
observable:
- name: parameters.owner
type: User
@@ -66,3 +67,4 @@ tags:
- parameters.doc_type
risk_score: 72
security_domain: endpoint
detections/cloud/gsuite_email_suspicious_attachment.yml
+1
View File
@@ -41,6 +41,7 @@ tags:
message: suspicious email from $source.address$ to $destination{}.address$
mitre_attack_id:
- T1566.001
- T1566
observable:
- name: source.address
type: User
detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+1
View File
@@ -49,6 +49,7 @@ tags:
message: suspicious email from $source.address$ to $destination{}.address$
mitre_attack_id:
- T1566.001
- T1566
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+1
View File
@@ -40,6 +40,7 @@ tags:
message: suspicious email from $source.address$ to $destination{}.address$
mitre_attack_id:
- T1566.001
- T1566
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
+1
View File
@@ -40,6 +40,7 @@ tags:
message: suspicious email from $source.address$ to $destination{}.address$
mitre_attack_id:
- T1048.003
- T1048
observable:
- name: source.address
type: User
detections/cloud/gsuite_suspicious_shared_file_name.yml
+1
View File
@@ -46,6 +46,7 @@ tags:
message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
mitre_attack_id:
- T1566.001
- T1566
observable:
- name: parameters.owner
type: User
detections/cloud/o365_add_app_role_assignment_grant_user.yml
+1
View File
@@ -41,6 +41,7 @@ tags:
Address $ActorIpAddress$
mitre_attack_id:
- T1136.003
- T1136
observable:
- name: ActorIpAddress
type: IP Address
detections/cloud/o365_added_service_principal.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
service principal credentials from IP Address $ActorIpAddress$
mitre_attack_id:
- T1136.003
- T1136
observable:
- name: ActorIpAddress
type: IP Address
detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+1
View File
@@ -45,6 +45,7 @@ tags:
list of trusted IPs to bypass MFA
mitre_attack_id:
- T1562.007
- T1562
observable:
- name: ip_addresses_new_added
type: IP Address
detections/cloud/o365_new_federated_domain_added.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
$OrganizationName$
mitre_attack_id:
- T1136.003
- T1136
observable:
- name: OrganizationName
type: Other
detections/cloud/o365_suspicious_admin_email_forwarding.yml
+1
View File
@@ -39,6 +39,7 @@ tags:
the same destination $ForwardingAddress$
mitre_attack_id:
- T1114.003
- T1114
nist:
- DE.DP
- DE.AE
detections/cloud/o365_suspicious_rights_delegation.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
that allow access to sensitive
mitre_attack_id:
- T1114.002
- T1114
nist:
- DE.DP
- DE.AE
detections/cloud/o365_suspicious_user_email_forwarding.yml
+1
View File
@@ -39,6 +39,7 @@ tags:
a forwarding rule to same destination $ForwardingSmtpAddress$
mitre_attack_id:
- T1114.003
- T1114
nist:
- DE.DP
- DE.AE