Branch was auto-updated.

detections/endpoint/excessive_usage_of_net_app.yml

@@ -47,3 +47,26 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 40
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 28
+  context:
+  - Source:Endpoint
+  - Scope:Local
+  - Stage:Execution
+  message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_name
+    type: Process Name
+    role:
+    - Process
+    - Attacker

detections/endpoint/excessive_usage_of_nslookup_app.yml

@@ -6,7 +6,7 @@ author: Teoderick Contreras, Stanislav Miskovic, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect potential DNS exfiltration using nslookup application.
+description: This search is to detect potential DNS exfiltration using nslookup application.
   This technique are seen in couple of malware and APT group to exfiltrated collected
   data in a infected machine or infected network. This detection is looking for unique
   use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are
@@ -50,3 +50,17 @@ tags:
   - process_name
   - EventCode
   security_domain: endpoint
+  impact: 40
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 28
+  context:
+  - Source:Endpoint
+  - Scope:Local
+  - Stage:Exfiltration
+  message: Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/excessive_usage_of_taskkill.yml

@@ -45,3 +45,26 @@ tags:
   - Processes.process
   - Processes.process_id
   security_domain: endpoint
+  impact: 40
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 28
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Excessive usage  of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. 
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+    - Attacker
+

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -53,3 +53,26 @@ tags:
   - Filesystem.file_name
   - Filesystem.user
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+
+  message: Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Attacker
+  - name: file_name
+    type: File Name
+    role:
+    - Other
+    - Attacker

detections/endpoint/execute_javascript_with_jscript_com_clsid.yml

@@ -46,3 +46,29 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Attacker
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+    - Attacker

detections/endpoint/execution_of_file_with_multiple_extensions.yml

@@ -51,3 +51,26 @@ tags:
   - Processes.user
   - Processes.parent_process
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: process $process$ have double extensions in the file name is executed on $dest$ by $user$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process
+    type: Process
+    role:
+    - Parent Process
+    - Attacker
+

detections/endpoint/extract_sam_from_registry.yml

@@ -50,3 +50,26 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  - Stage:Execution
+  message: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process_id
+    type: Process
+    role:
+    - Parent Process
+    - Attacker

detections/endpoint/file_with_samsam_extension.yml

@@ -47,3 +47,25 @@ tags:
   - Filesystem.file_path
   - Filesystem.file_name
   security_domain: endpoint
+  impact: 100
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Other
+    - Attacker

detections/endpoint/first_time_seen_child_process_of_zoom.yml

@@ -62,3 +62,26 @@ tags:
   - Processes.process_id
   - Processes.dest
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_name
+    type: Process Name
+    role:
+    - Attacker
+    - Child Process
+

detections/endpoint/fodhelper_uac_bypass.yml

@@ -61,3 +61,25 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+    - Attacker

detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml

@@ -53,3 +53,31 @@ tags:
   - dest_port
   - process_path
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Command And Control
+  message: Process gpupdate.exe  with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+    - Attacker
+  - name: connection_to_CNC
+    type: IP Address
+    role:
+    - Other
+

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -48,3 +48,24 @@ tags:
   - Registry.registry_value_name
   - Registry.dest Registry.user
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Execution 
+  message: Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: registry_value_name
+    type: Other
+    role:
+    - Attacker

detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml

@@ -51,3 +51,26 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion 
+  - Stage:Persistence
+  message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process
+    type: Other
+    role:
+    - Attacker
+    - Parent Process

detections/endpoint/high_file_deletion_frequency.yml

@@ -46,3 +46,24 @@ tags:
   - ProcessID
   - _time
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: High frequency file deletion activity detected on host $Computer$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: deleted_files
+    type: File Name
+    role:
+    - Target

detections/endpoint/high_process_termination_frequency.yml

@@ -42,3 +42,20 @@ tags:
   - _time
   - ProcessID
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: High frequency process termination (more than 15 processes within 3s) detected on host $Computer$
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: proc_terminated
+    type: Process
+    role:
+    - Target

detections/endpoint/icacls_deny_command.yml

@@ -48,3 +48,20 @@ tags:
   - Processes.process_id
   - Processes.process
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ 
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim

detections/endpoint/icacls_grant_command.yml

@@ -48,3 +48,20 @@ tags:
   - Processes.process_id
   - Processes.process
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ 
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -47,3 +47,16 @@ tags:
   - service
   - service_id
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: Potential kerberoasting attack via service principal name requests detected on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/known_services_killed_by_ransomware.yml

@@ -44,3 +44,20 @@ tags:
   - dest
   - Type
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Known services $Message$ terminated by a potential ransomware on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Message
+    type: Other
+    role:
+    - Other

detections/endpoint/mailsniper_invoke_functions.yml

@@ -43,3 +43,21 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+

detections/endpoint/malicious_powershell_executed_as_a_service.yml

@@ -47,3 +47,20 @@ tags:
   - Service_Account
   - user
   security_domain: endpoint
+  impact: 90
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim

detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml

@@ -61,3 +61,25 @@ tags:
   - Processes.parent_process_name
   - Processes.dest
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Command And Control
+  message: PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process
+    type: Process
+    role:
+    - Attacker