diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index e2b5685182..ca05acb70a 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: execution of copy exe to copy file from $process$ in $dest$ + message: Execution of copy exe to copy file from $process$ in $dest$ mitre_attack_id: - T1036.003 - T1036 @@ -53,7 +53,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index ec10fa68a3..8e2ddc5f2e 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -45,7 +45,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index f529914316..e6debc35f6 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -15,8 +15,7 @@ description: The following analytic utilizes Windows Event ID 1100 to identify w data_source: - Sysmon Event ID 1 search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime - max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter` + max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. known_false_positives: It is possible the Event Logging service gets shut down due @@ -34,12 +33,12 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: The Windows Event Log Service shutdown on $ComputerName$ + message: The Windows Event Log Service shutdown on $dest$ mitre_attack_id: - T1070 - T1070.001 observable: - - name: ComputerName + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 29a48aa774..4738799e56 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -44,7 +44,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 71ccd0031f..b4bb38d0d7 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -38,11 +38,11 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: process $process_name$ creating image file $file_path$ in $dest$ + message: Process $process_name$ creating image file $file_path$ in $dest$ mitre_attack_id: - T1113 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml index 601d78cd6d..3417d6487d 100644 --- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -17,8 +17,8 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain data_source: - Windows Security 4769 search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name) - = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 | - table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious + = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 | rename ComputerName as dest| rename Account_Name as user | + table _time, dest, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious | `suspicious_kerberos_service_ticket_request_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting @@ -42,12 +42,12 @@ tags: - CVE-2021-42287 - CVE-2021-42278 impact: 100 - message: A suspicious Kerberos Service Ticket was requested by $Account_Name$ + message: A suspicious Kerberos Service Ticket was requested by $user$ on host $dest$ mitre_attack_id: - T1078 - T1078.002 observable: - - name: ComputerName + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 1abdf8ecf7..7c8d8ef0a9 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -41,7 +41,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index b077b803e7..a9e624f9ee 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -52,7 +52,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 373a1cd15f..cfec80df30 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -46,7 +46,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 77296cf780..360a61303b 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 1d8c98c32f..3cd156d2da 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -16,7 +16,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver* - by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter`' diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml index e672e78c55..7bf721cddb 100644 --- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -52,7 +52,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index e1691ee157..6c89d07b94 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -45,7 +45,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 70 - message: rundll32.exe running with suspicious parameters on $dest$ + message: rundll32.exe running with suspicious StartW parameters on $dest$ mitre_attack_id: - T1218 - T1218.011 @@ -54,7 +54,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 9c6c84890d..a9aa2fdc8e 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 70 - message: Suspicious scheduled task registered on $dest$ + message: Suspicious scheduled task registered on $dest$ from Public Directory mitre_attack_id: - T1053.005 - T1053 @@ -44,7 +44,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index d1ed4de967..91ae5c584d 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -16,7 +16,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id - Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.process_name Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -45,7 +45,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 11ec1301dd..1e7be049f0 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -42,7 +42,7 @@ tags: mitre_attack_id: - T1113 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 6fc603e530..a08b894ea9 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -43,7 +43,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 3e65a806ac..1f4862157b 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -29,7 +29,7 @@ tags: asset_type: Windows confidence: 50 impact: 30 - message: Potential system information discovery behavior on $dest$ by $User$ + message: Potential system information discovery behavior on $dest$ by $user$ mitre_attack_id: - T1082 observable: @@ -37,7 +37,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Attacker diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 853c30860a..dba8ed1d42 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") - BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name + BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: - T1547.003 - T1547 diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 2878d34994..4dc76a4ded 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -10,10 +10,7 @@ description: This search is to detect a possible uac bypass using the colorui.dl where it make use of the colorui.dll COM CLSID to bypass UAC. data_source: - Sysmon Event ID 7 -search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" - NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as - firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode - Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest parent_process_name process_name ImageLoaded signature_id signature Signed user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -29,17 +26,13 @@ tags: asset_type: Endpoint confidence: 80 impact: 60 - message: The following module $ImageLoaded$ was loaded by a non-standard application - on endpoint $Computer$ by user $user$. + message: The following module $ImageLoaded$ was loaded by a non-standard application $parent_process_name$ + on endpoint $dest$ by user $user_id$. mitre_attack_id: - T1218 - T1218.003 observable: - - name: user - type: User - role: - - Victim - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index c2e3517095..29dd976bd9 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -34,16 +34,12 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: '' + message: Unknown process $process_name$ using the kerberos protocol detected on host $dest$ mitre_attack_id: - T1550 observable: - - name: src_ip - type: IP Address - role: - - Attacker - - name: dest_ip - type: IP Address + - name: dest + type: Hostname role: - Victim product: