From 8a1bed2fb9c8150baad8163fa8cc3aa3c463b44b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 11 Oct 2021 11:03:20 +0200 Subject: [PATCH 1/4] CARS_UPDATE_MITRE_ID_B1 --- .../abnormally_high_number_of_cloud_infrastructure_api_calls.yml | 1 + .../abnormally_high_number_of_cloud_security_group_api_calls.yml | 1 + .../cloud/aws_create_policy_version_to_allow_all_resources.yml | 1 + detections/cloud/aws_createaccesskey.yml | 1 + detections/cloud/aws_createloginprofile.yml | 1 + detections/cloud/aws_ecr_container_scanning_findings_high.yml | 1 + ...ecr_container_scanning_findings_low_informational_unknown.yml | 1 + detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 1 + .../cloud/aws_ecr_container_upload_outside_business_hours.yml | 1 + detections/cloud/aws_ecr_container_upload_unknown_user.yml | 1 + detections/cloud/aws_iam_successful_group_deletion.yml | 1 + ...s_network_access_control_list_created_with_all_open_ports.yml | 1 + detections/cloud/aws_network_access_control_list_deleted.yml | 1 + detections/cloud/aws_setdefaultpolicyversion.yml | 1 + detections/cloud/aws_updateloginprofile.yml | 1 + .../cloud_compute_instance_created_by_previously_unseen_user.yml | 1 + .../cloud_instance_modified_with_previously_unseen_user.yml | 1 + detections/cloud/correlation_by_repository_and_risk.yml | 1 + detections/cloud/correlation_by_user_and_risk.yml | 1 + detections/cloud/github_dependabot_alert.yml | 1 + detections/cloud/github_pull_request_from_unknown_user.yml | 1 + detections/cloud/gsuite_drive_share_in_external_email.yml | 1 + detections/cloud/gsuite_email_suspicious_attachment.yml | 1 + .../cloud/gsuite_email_suspicious_subject_with_attachment.yml | 1 + .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 1 + .../gsuite_outbound_email_with_attachment_to_external_domain.yml | 1 + detections/cloud/gsuite_suspicious_shared_file_name.yml | 1 + detections/cloud/o365_add_app_role_assignment_grant_user.yml | 1 + detections/cloud/o365_added_service_principal.yml | 1 + detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 1 + detections/cloud/o365_new_federated_domain_added.yml | 1 + detections/cloud/o365_suspicious_admin_email_forwarding.yml | 1 + detections/cloud/o365_suspicious_rights_delegation.yml | 1 + detections/cloud/o365_suspicious_user_email_forwarding.yml | 1 + 34 files changed, 34 insertions(+) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 0d15635152..71e463fbf9 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -44,6 +44,7 @@ tags: of $expected_upper_threshold$ with the following command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 2b216b747e..1228ec4926 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -49,6 +49,7 @@ tags: command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index eeda62b531..931bf81982 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -46,6 +46,7 @@ tags: in their account mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index ed140d24b7..5c2276390f 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -43,6 +43,7 @@ tags: from this IP $src$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index b537158602..5a203a77d8 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -46,6 +46,7 @@ tags: and did a console login from this IP $src_ip$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index e7eca8106c..9a9eeb3114 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -37,6 +37,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index f6c36e1a8a..2baabc0834 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -36,6 +36,7 @@ tags: message: Vulnerabilities with severity high found in repository $repositoryName$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index eda8bdae60..755368af77 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -35,6 +35,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 2d193b4d16..e64f1de95b 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded outside business hours from $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 0e15c5211e..82d4fd850e 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded from unknown user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 6efc567d1d..c39a47fc4d 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -42,6 +42,7 @@ tags: mitre_attack_id: - T1069.003 - T1098 + - T1069 observable: - name: src type: IP Address diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index a7059316a2..028c55621a 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -46,6 +46,7 @@ tags: CIDR $requestParameters.cidrBlock$ mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 55634ba086..5a09c419bf 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -41,6 +41,7 @@ tags: $eventName$), such that the instance is accessible from anywhere mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 546333f7e9..6f90e57391 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -45,6 +45,7 @@ tags: event $eventName$ for updating the the default policy version mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 2d6d80437e..0c7fd9c7b2 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -39,6 +39,7 @@ tags: user $user_arn$ more access privilleges mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index f70c6e911a..43c8ea2de0 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is creating a new instance $dest$ for the first time mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 185d54b516..f05c111905 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is modifying an instance $dest$ for the first time. mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 78763720ca..8cae1eaf2f 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 6cbb1f0832..220dcb76c1 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 4294037188..0ac8b391b0 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 3f4235831b..82025ef1a6 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index b451a2c38f..7ce9b0e3bd 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -41,6 +41,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1567.002 + - T1567 observable: - name: parameters.owner type: User diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 664b291d70..5bf5875a1f 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -41,6 +41,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index be34394965..43da966e82 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -49,6 +49,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index aaf6b6cf5f..9ed9c63dd0 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index d4e3964783..c3792b9f3f 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1048.003 + - T1048 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 65c240346c..13bb20d2aa 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -46,6 +46,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: parameters.owner type: User diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 577c75383a..731f801395 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -41,6 +41,7 @@ tags: Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index ea17167487..6bcfb6259b 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -44,6 +44,7 @@ tags: service principal credentials from IP Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 1fc40093a1..4a9a8ef9ea 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -45,6 +45,7 @@ tags: list of trusted IPs to bypass MFA mitre_attack_id: - T1562.007 + - T1562 observable: - name: ip_addresses_new_added type: IP Address diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 5984dfc60d..7a416e6f60 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -44,6 +44,7 @@ tags: $OrganizationName$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: OrganizationName type: Other diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 82746f0989..cbb85e57e6 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -39,6 +39,7 @@ tags: the same destination $ForwardingAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 06d05f296e..be8f002199 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -38,6 +38,7 @@ tags: that allow access to sensitive mitre_attack_id: - T1114.002 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 9a7276d8b6..7644ef34f2 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -39,6 +39,7 @@ tags: a forwarding rule to same destination $ForwardingSmtpAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE From cd46d4cf61a0c201112a70271f601b0baefae1bd Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 11 Oct 2021 11:05:34 +0200 Subject: [PATCH 2/4] Delete screensaver_event_trigger_execution.yml --- .../screensaver_event_trigger_execution.yml | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 detections/endpoint/screensaver_event_trigger_execution.yml diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml deleted file mode 100644 index dd457c5f95..0000000000 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Screensaver Event Trigger Execution -id: 58cea3ec-1f6d-11ec-8560-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -type: TTP -datamodel: -- Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. - This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution - to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `screensaver_event_trigger_execution_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1546.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - security_domain: endpoint - impact: 80 - confidence: 90 - # (impact * confidence)/100 - risk_score: 72 - context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: user - role: - - Victim - \ No newline at end of file From e564e5a9f2651115f355be698f764f0bac8892e6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 11 Oct 2021 11:05:42 +0200 Subject: [PATCH 3/4] Delete screensaver_event_trigger_execution.test.yml --- .../screensaver_event_trigger_execution.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/screensaver_event_trigger_execution.test.yml diff --git a/tests/endpoint/screensaver_event_trigger_execution.test.yml b/tests/endpoint/screensaver_event_trigger_execution.test.yml deleted file mode 100644 index 4e398660f6..0000000000 --- a/tests/endpoint/screensaver_event_trigger_execution.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Screensaver Event Trigger Execution Unit Test -tests: -- name: Screensaver Event Trigger Execution - file: endpoint/screensaver_event_trigger_execution.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From d2719d316e4327d3b36da1befe53338056044e30 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:12:12 +0200 Subject: [PATCH 4/4] Update gsuite_drive_share_in_external_email.yml --- detections/cloud/gsuite_drive_share_in_external_email.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 7ce9b0e3bd..552014e94a 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -67,3 +67,4 @@ tags: - parameters.doc_type risk_score: 72 security_domain: endpoint +