diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 06df72a3bd..cec01c4d5e 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. - This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow +description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. + This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest - Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 - | `drop_dm_object_name(Processes)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`' @@ -24,14 +24,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: administrator may do this commandline for auditing and testing purposes. +known_false_positives: administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed. references: - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: - - Cyclops BLink + - CyclopsBLink asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index ea3ad76690..0d82dbfbdc 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic looks for suspicious process kworker commandline in a linux machine. - kworker process name or thread are common names of kernel threads in linux process. - This hunting detections can lead to investigate process contains process path in - writable directory in linux like /home/, /var/log and /tmp/. This technique was seen - in cyclopsblink malware to blend its core and other of its child process as normal - kworker on the compromised machine. This detection might be a good pivot to look for +description: This analytic looks for suspicious process kworker commandline in a linux machine. + kworker process name or thread are common names of kernel threads in linux process. + This hunting detections can lead to investigate process contains process path in + writable directory in linux like /home/, /var/log and /tmp/. This technique was seen + in cyclopsblink malware to blend its core and other of its child process as normal + kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path - Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` + Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter`' @@ -31,7 +31,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: - - Cyclops BLink + - CyclopsBLink asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml index 3d1f335194..8d591eef56 100644 --- a/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. - This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the +description: This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. + This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*&>/dev/null*" - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*&>/dev/null*" + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name - | `drop_dm_object_name(Processes)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `linux_stdout_redirection_to_dev_null_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,7 +27,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: - - Cyclops BLink + - CyclopsBLink - Industroyer2 asset_type: Endpoint cis20: diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index fdd22fbbb1..32bdfab0c3 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.38.1" + "version": "3.39.0" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 9132d4dcbd..a5508d01bb 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,12 +1,22 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# ### DETECTIONS ### +[savedsearch://ESCU - Path traversal SPL injection - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"]} +known_false_positives = This search may find additional path traversal exploitation attempts. +providing_technologies = [] + [savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule] type = detection asset_type = Endpoint @@ -17,6 +27,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = None. providing_technologies = [] +[savedsearch://ESCU - Splunk User Enumeration Attempt - Rule] +type = detection +asset_type = endpoint +confidence = medium +explanation = On May 3rd, 2022, Splunk published a security advisory for username enumeration stemming from verbose login failure messages present on some REST endpoints. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078"], "nist": ["DE.CM"]} +known_false_positives = Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. +providing_technologies = [] + +[savedsearch://ESCU - Splunk XSS in Monitoring Console - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]} +known_false_positives = Use of the monitoring console where the less-than sign (<) is the first character in the description field. +providing_technologies = [] + [savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] type = detection asset_type = AWS Instance @@ -4294,11 +4324,11 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]} known_false_positives = Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type. providing_technologies = [] -[savedsearch://ESCU - Linux Kworker Process CommandLine - Rule] +[savedsearch://ESCU - Linux Kworker Process In Writable Process Path - Rule] type = detection asset_type = Endpoint confidence = medium -explanation = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common name of kernel thread in linux process. So it is really a suspicious event a normal user process contain this process commandline. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. +explanation = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common names of kernel threads in linux process. This hunting detections can lead to investigate process contains process path in writable directory in linux like /home/, /var/log and /tmp/. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.004", "T1036"], "nist": ["DE.CM"]} known_false_positives = unknown @@ -4464,16 +4494,6 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives. providing_technologies = [] -[savedsearch://ESCU - Linux Stdout Redirection To Dev Null File - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"]} -known_false_positives = unknown -providing_technologies = [] - [savedsearch://ESCU - Linux Sudo OR Su Execution - Rule] type = detection asset_type = Endpoint @@ -6280,16 +6300,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1005"]} known_false_positives = unknown providing_technologies = [] -[savedsearch://ESCU - Start Up During Safe Mode Boot - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]} -known_false_positives = updated windows application needed in safe boot may used this registry -providing_technologies = [] - [savedsearch://ESCU - Suspicious Computer Account Name Change - Rule] type = detection asset_type = Endpoint @@ -6906,6 +6916,36 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons providing_technologies = [] +[savedsearch://ESCU - Windows Computer Account Created by Computer Account - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifes a Computer Account creating a new Computer Account with specific a Service Principle Name - "RestrictedKrbHost". The RestrictedKrbHost service class allows client applications to use Kerberos authentication when they do not have the identity of the service but have the server name. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +known_false_positives = It is possible third party applications may have a computer account that adds computer accounts, filtering may be required. +providing_technologies = [] + +[savedsearch://ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a ComputerAccount requesting a Kerberos Ticket. typically, a user account requests a Kerberos ticket. This behavior was identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar behavior. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +known_false_positives = It is possible false positives will be present based on third party applications. Filtering may be needed. +providing_technologies = [] + +[savedsearch://ESCU - Windows Computer Account With SPN - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added using the KrbRelayUp behavior. This particular behavior has been found in other Kerberos based attacks. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +known_false_positives = It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed. +providing_technologies = [] + [savedsearch://ESCU - Windows Curl Download to Suspicious Path - Rule] type = detection asset_type = Endpoint @@ -7085,6 +7125,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", known_false_positives = False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use. providing_technologies = [] +[savedsearch://ESCU - Windows Drivers Loaded by Signature - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic assists with viewing all drivers being loaded by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to assist with identifying suspicious drivers. Use this analytic to look at prevalence of driver (count), path of driver, signature status and hash. Review these fields with scrutiny until the ability to prove the driver is legitimate and has a purpose in the environment. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1014"], "nist": ["DE.CM"]} +known_false_positives = This analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat. +providing_technologies = [] + [savedsearch://ESCU - Windows Event For Service Disabled - Rule] type = detection asset_type = Endpoint @@ -7275,6 +7325,36 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.00 known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. providing_technologies = [] +[savedsearch://ESCU - Windows ISO LNK File Creation - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566", "T1204.001", "T1204"], "nist": ["DE.CM"]} +known_false_positives = False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Windows Kerberos Local Successful Logon - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. The target user security identified will be set to the built-in local Administrator account, along with the remote address as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. Upon triage, review for recently ran binaries on disk. In addition, look for new computer accounts added to Active Directory and other anomolous AD events. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +known_false_positives = False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Windows KrbRelayUp Service Creation - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies the default service name created by KrbRelayUp. Defenders should be aware that attackers could change the hardcoded service name of the KrbRelayUp tool and bypass this detection. +how_to_implement = To successfully implement this search, you need to be ingesting Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also required. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "nist": ["DE.CM"]} +known_false_positives = False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule] type = detection asset_type = Endpoint @@ -7399,6 +7479,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection. providing_technologies = [] +[savedsearch://ESCU - Windows Registry Certificate Added - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["DE.CM"]} +known_false_positives = False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint. +providing_technologies = [] + +[savedsearch://ESCU - Windows Registry Delete Task SD - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]} +known_false_positives = False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel. +providing_technologies = [] + +[savedsearch://ESCU - Windows Registry Modification for Safe Mode Persistence - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal and Network. adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]} +known_false_positives = updated windows application needed in safe boot may used this registry +providing_technologies = [] + [savedsearch://ESCU - Windows Remote Assistance Spawning Process - Rule] type = detection asset_type = Endpoint @@ -8188,6 +8298,16 @@ annotations = {"cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation" known_false_positives = A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process. providing_technologies = [] +[savedsearch://ESCU - Linux Stdout Redirection To Dev Null File - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - MacOS - Re-opened Applications - Rule] type = detection asset_type = Endpoint @@ -8904,7 +9024,7 @@ version = 1 references = ["https://en.wikipedia.org/wiki/Kerberos_(protocol)", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9", "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/", "https://attack.mitre.org/techniques/T1558/003/", "https://attack.mitre.org/techniques/T1550/003/", "https://attack.mitre.org/techniques/T1558/004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}] spec_version = 3 -searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule", "ESCU - Kerberos TGT Request Using RC4 Encryption - Rule", "ESCU - Kerberos User Enumeration - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule", "ESCU - Unknown Process Using The Kerberos Protocol - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule", "ESCU - Windows PowerView Constrained Delegation Discovery - Rule", "ESCU - Windows PowerView Unconstrained Delegation Discovery - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule"] +searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule", "ESCU - Kerberos TGT Request Using RC4 Encryption - Rule", "ESCU - Kerberos User Enumeration - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule", "ESCU - Unknown Process Using The Kerberos Protocol - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule", "ESCU - Windows Computer Account Created by Computer Account - Rule", "ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule", "ESCU - Windows Computer Account With SPN - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule", "ESCU - Windows Kerberos Local Successful Logon - Rule", "ESCU - Windows PowerView Constrained Delegation Discovery - Rule", "ESCU - Windows PowerView Unconstrained Delegation Discovery - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule"] description = Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. narrative = Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in Kerberos based attacks. @@ -9581,6 +9701,17 @@ These state-sponsored actors are thought to be responsible for everything from a In June of 2018, The Department of Homeland Security, together with the FBI and other U.S. government partners, issued Technical Alert (TA-18-149A) to advise the public about two variants of North Korean malware. One variant, dubbed "Joanap," is a multi-stage peer-to-peer botnet that allows North Korean state actors to exfiltrate data, download and execute secondary payloads, and initialize proxy communications. The other variant, "Brambul," is a Windows32 SMB worm that is dropped into a victim network. When executed, the malware attempts to spread laterally within a victim's local subnet, connecting via the SMB protocol and initiating brute-force password attacks. It reports details to the Hidden Cobra actors via email, so they can use the information for secondary remote operations.\ Among other searches in this Analytic Story is a detection search that looks for the creation or deletion of hidden shares, such as, "adnim$," which the Hidden Cobra malware creates on the target system. Another looks for the creation of three malicious files associated with the malware. You can also use a search in this story to investigate activity that indicates that malware is sending email back to the attackers. +[analytic_story://Industroyer2] +category = Malware +last_updated = 2022-04-21 +version = 1 +references = ["https://cert.gov.ua/article/39518", "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] +spec_version = 3 +searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Linux DD File Overwrite - Rule", "ESCU - Linux System Network Discovery - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Linux Stdout Redirection To Dev Null File - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Industroyer2 attack, including file writes associated with its payload, lateral movement, persistence, privilege escalation and data destruction. +narrative = Industroyer2 is part of continuous attack to ukraine targeting energy facilities. This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments. This attack consist of several destructive linux script component to wipe or delete several linux critical files, powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host. + [analytic_story://Information Sabotage] category = Abuse last_updated = 2021-11-17 @@ -9694,6 +9825,17 @@ searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download Fil description = Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. narrative = Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. +[analytic_story://Local Privilege Escalation With KrbRelayUp] +category = Privilege Escalation +last_updated = 2022-04-28 +version = 1 +references = ["https://github.com/Dec0ne/KrbRelayUp", "https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9", "https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html", "https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/", "https://github.com/cube0x0/KrbRelay"] +maintainers = [{"company": "Mauricio Velazco, Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Windows Computer Account Created by Computer Account - Rule", "ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule", "ESCU - Windows Computer Account With SPN - Rule", "ESCU - Windows Kerberos Local Successful Logon - Rule", "ESCU - Windows KrbRelayUp Service Creation - Rule"] +description = KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers. +narrative = In October 2021, James Forshaw from Googles Project Zero released a research blog post titled `Using Kerberos for Authentication Relay Attacks`. This research introduced, for the first time, ways to make Windows authenticate to a different Service Principal Name (SPN) than what would normally be derived from the hostname the client is connecting to. This effectively proved that relaying Kerberos authentication is possible\\. In April 2022, security researcher Mor Davidovich released a tool named KrbRelayUp which implements Kerberos relaying as well as other known Kerberos techniques with the goal of escalating privileges from a low-privileged domain user on a domain-joined device and obtain a SYSTEM shell. + [analytic_story://Log4Shell CVE-2021-44228] category = Adversary Tactics last_updated = 2021-12-11 @@ -9931,7 +10073,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] +searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -10073,7 +10215,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"] +searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -10088,10 +10230,10 @@ This Analytic Story focuses on detecting signs that a malicious payload has been category = Best Practices last_updated = 2022-03-28 version = 1 -references = ["https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422"] +references = ["https://www.splunk.com/en_us/product-security/announcements.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}] spec_version = 3 -searches = ["ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule"] +searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule"] description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. @@ -10491,6 +10633,17 @@ searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). +[analytic_story://Windows Drivers] +category = +last_updated = 2022-03-30 +version = 1 +references = ["https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Windows Drivers Loaded by Signature - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule"] +description = Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. +narrative = A rootkit on Windows may sometimes be in the form of a Windows Driver. A driver typically has a file extension of .sys, however the internals of a sys file is similar to a Windows DLL. For Microsoft Windows to load a driver, a few requirements are needed. First, it must have a valid signature. Second, typically it should load from the windows\system32\drivers path. There are a few methods to investigate drivers in the environment. Drivers are noisy. An inventory of all drivers is important to understand prevalence. A driver location (Path) is also important when attempting to baseline. Looking at a driver name and path is not enough, we must also explore the signing information. Product, description, company name, signer and signing result are all items to take into account when reviewing drivers. What makes a driver malicious? Depending if a driver was dropped during a campaign or you are baselining drivers after, triaging a driver to determine maliciousness may be tough. We break this into two categories - 1. vulnerable drivers 2. driver rootkits. Attempt to identify prevelance of the driver. Is it on one or many? Review the signing information if it is present. Is it common? A lot of driver hunting will lead down rabbit holes, but we hope to help lead the way. + [analytic_story://Windows File Extension and Association Abuse] category = Malware last_updated = 2018-01-26 @@ -10525,7 +10678,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -10547,7 +10700,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1112/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"] description = Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner. narrative = Windows Registry is one of the powerful and yet still mysterious Windows features that can tweak or manipulate Windows policies and low-level configuration settings. Because of this capability, most malware, adversaries or threat actors abuse this hierarchical database to do their malicious intent on a targeted host or network environment. In these cases, attackers often use tools to create or modify registry in ways that are not typical for most environments, providing opportunities for detection. diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index bbbebad7bf..87c01db72b 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 7313 +build = 7579 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.38.1 +version = 3.39.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index f733d488e6..c85a3c3582 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 5c965a0a69..fc54316676 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.38.1 +version = 3.39.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 8d33223020..ca4c643811 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 4d57db512e..00dbf290f1 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,14 +1,26 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# +[path_traversal_spl_injection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [splunk_dos_via_malformed_s2s_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_user_enumeration_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_xss_in_monitoring_console_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [abnormally_high_number_of_cloud_infrastructure_api_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1685,7 +1697,7 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[linux_kworker_process_commandline_filter] +[linux_kworker_process_in_writable_process_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1753,10 +1765,6 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[linux_stdout_redirection_to_dev_null_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [linux_sudo_or_su_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2457,10 +2465,6 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[start_up_during_safe_mode_boot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [suspicious_computer_account_name_change_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2705,6 +2709,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_computer_account_created_by_computer_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_computer_account_requesting_kerberos_ticket_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_computer_account_with_spn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_curl_download_to_suspicious_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2773,6 +2789,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_drivers_loaded_by_signature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_event_for_service_disabled_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2841,6 +2861,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_iso_lnk_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_kerberos_local_successful_logon_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_krbrelayup_service_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_modify_show_compress_color_and_info_tip_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2889,6 +2921,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_registry_certificate_added_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_registry_delete_task_sd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_registry_modification_for_safe_mode_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_remote_assistance_spawning_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3193,6 +3237,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[linux_stdout_redirection_to_dev_null_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [macos___re_opened_applications_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3658,6 +3706,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[path_traversal_spl_injection] +definition = index=_internal sourcetype=splunkd_ui_access +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [potentially_malicious_code_on_cmdline_tokenize_score] definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0) description = Performs the tokenization and application of the malicious commandline classifier @@ -3939,6 +3991,14 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = index=_internal sourcetype=splunkd description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[splunkd_failed_auths] +definition = index=_audit action="login attempt" info="failed" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + +[splunkd_web] +definition = index=_internal sourcetype=splunk_web_access +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [stream_dns] definition = sourcetype=stream:dns description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index a88cfd4686..162bc1ca64 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,11 +1,57 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# ### ESCU DETECTIONS ### +[ESCU - Path traversal SPL injection - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"]} +action.escu.data_models = [] +action.escu.eli5 = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. +action.escu.known_false_positives = This search may find additional path traversal exploitation attempts. +action.escu.creation_date = 2022-04-29 +action.escu.modification_date = 2022-04-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Path traversal SPL injection - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Path traversal exploitation attempt from $clientip$ +action.risk.param._risk = [{"risk_object_field": "clientip", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Path traversal SPL injection - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-26889"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +action.notable.param.rule_title = Path traversal SPL injection +action.notable.param.security_domain = threat +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by status clientip method uri_path uri_query | `path_traversal_spl_injection_filter` + [ESCU - Splunk DoS via Malformed S2S Request - Rule] action.escu = 0 action.escu.enabled = 1 @@ -36,7 +82,7 @@ action.correlationsearch.label = ESCU - Splunk DoS via Malformed S2S Request - R action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2021-3422"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1498"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. action.notable.param.rule_title = Splunk DoS via Malformed S2S Request action.notable.param.security_domain = threat @@ -50,7 +96,99 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter` +search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter` + +[ESCU - Splunk User Enumeration Attempt - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On May 3rd, 2022, Splunk published a security advisory for username enumeration stemming from verbose login failure messages present on some REST endpoints. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On May 3rd, 2022, Splunk published a security advisory for username enumeration stemming from verbose login failure messages present on some REST endpoints. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. +action.escu.known_false_positives = Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. +action.escu.creation_date = 2022-04-29 +action.escu.modification_date = 2022-04-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk User Enumeration Attempt - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. +action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk User Enumeration Attempt - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2021-33845"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078"], "nist": ["DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = On May 3rd, 2022, Splunk published a security advisory for username enumeration stemming from verbose login failure messages present on some REST endpoints. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +action.notable.param.rule_title = Splunk User Enumeration Attempt +action.notable.param.security_domain = access +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as "Users", sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter` + +[ESCU - Splunk XSS in Monitoring Console - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. +action.escu.known_false_positives = Use of the monitoring console where the less-than sign (<) is the first character in the description field. +action.escu.creation_date = 2022-04-27 +action.escu.modification_date = 2022-04-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk XSS in Monitoring Console - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = A potential XSS attempt has been detected from $user$ +action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk XSS in Monitoring Console - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-27183"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +action.notable.param.rule_title = Splunk XSS in Monitoring Console +action.notable.param.security_domain = threat +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd_web` method="GET" uri_query="description=%3C*" | table _time host status clientip user uri | `splunk_xss_in_monitoring_console_filter` [ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] action.escu = 0 @@ -162,7 +300,7 @@ action.correlationsearch.label = ESCU - AWS Create Policy Version to allow all r action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account action.notable.param.rule_title = AWS Create Policy Version to allow all resources action.notable.param.security_domain = network @@ -248,7 +386,7 @@ action.correlationsearch.label = ESCU - AWS CreateLoginProfile - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip action.notable.param.rule_title = AWS CreateLoginProfile action.notable.param.security_domain = network @@ -334,7 +472,7 @@ action.correlationsearch.label = ESCU - AWS Detect Users creating keys with encr action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"], "observable": [{"name": "userIdentity.principalId", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company. action.notable.param.rule_title = AWS Detect Users creating keys with encrypt policy without MFA action.notable.param.security_domain = threat @@ -420,7 +558,7 @@ action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "context": ["Source:Cloud Data", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. action.notable.param.rule_title = AWS ECR Container Scanning Findings High action.notable.param.security_domain = network @@ -626,7 +764,7 @@ action.correlationsearch.label = ESCU - AWS Excessive Security Scanning - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. action.notable.param.rule_title = AWS Excessive Security Scanning action.notable.param.security_domain = network @@ -712,7 +850,7 @@ action.correlationsearch.label = ESCU - AWS IAM Assume Role Policy Brute Force - action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Credential Access", "Other:Policy Violation"], "impact": 40, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing. action.notable.param.rule_title = AWS IAM Assume Role Policy Brute Force action.notable.param.security_domain = access @@ -918,7 +1056,7 @@ action.correlationsearch.label = ESCU - AWS Network Access Control List Created action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "userName", "role": ["Victim"], "type": "User"}, {"name": "requestParameters.cidrBlock", "role": ["Victim"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. action.notable.param.rule_title = AWS Network Access Control List Created with All Open Ports action.notable.param.security_domain = network @@ -1044,7 +1182,7 @@ action.correlationsearch.label = ESCU - AWS SAML Update identity provider - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"], "observable": [{"name": "sourceIPAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "userIdentity.principalId", "role": ["Victim", "Target"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. action.notable.param.rule_title = AWS SAML Update identity provider action.notable.param.security_domain = threat @@ -1090,7 +1228,7 @@ action.correlationsearch.label = ESCU - AWS SetDefaultPolicyVersion - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy action.notable.param.rule_title = AWS SetDefaultPolicyVersion action.notable.param.security_domain = threat @@ -1136,7 +1274,7 @@ action.correlationsearch.label = ESCU - AWS UpdateLoginProfile - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.notable.param.rule_title = AWS UpdateLoginProfile action.notable.param.security_domain = threat @@ -1666,7 +1804,7 @@ action.correlationsearch.label = ESCU - Correlation by Repository and Risk - Rul action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "context": ["Unknown"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search correlations detections by repository and risk_score action.notable.param.rule_title = Correlation by Repository and Risk action.notable.param.security_domain = network @@ -1712,7 +1850,7 @@ action.correlationsearch.label = ESCU - Correlation by User and Risk - Rule action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "context": ["Unknown"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search correlations detections by user and risk_score action.notable.param.rule_title = Correlation by User and Risk action.notable.param.security_domain = network @@ -1918,7 +2056,7 @@ action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.notable.param.rule_title = Detect New Open S3 buckets action.notable.param.security_domain = threat @@ -1964,7 +2102,7 @@ action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.notable.param.rule_title = Detect New Open S3 Buckets over AWS CLI action.notable.param.security_domain = threat @@ -2010,7 +2148,7 @@ action.correlationsearch.label = ESCU - Detect shared ec2 snapshot - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. action.notable.param.rule_title = Detect shared ec2 snapshot action.notable.param.security_domain = threat @@ -2536,7 +2674,7 @@ action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress LFI - Rule action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Unknown"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks. action.notable.param.rule_title = Kubernetes Nginx Ingress LFI action.notable.param.security_domain = network @@ -2582,7 +2720,7 @@ action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress RFI - Rule action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Unknown"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks. action.notable.param.rule_title = Kubernetes Nginx Ingress RFI action.notable.param.security_domain = network @@ -2628,7 +2766,7 @@ action.correlationsearch.label = ESCU - Kubernetes Scanner Image Pulling - Rule action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "context": ["Unknown"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "host", "role": ["Attacker"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner. action.notable.param.rule_title = Kubernetes Scanner Image Pulling action.notable.param.security_domain = network @@ -2674,7 +2812,7 @@ action.correlationsearch.label = ESCU - O365 Add App Role Assignment Grant User action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. action.notable.param.rule_title = O365 Add App Role Assignment Grant User action.notable.param.security_domain = threat @@ -2720,7 +2858,7 @@ action.correlationsearch.label = ESCU - O365 Added Service Principal - Rule action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. action.notable.param.rule_title = O365 Added Service Principal action.notable.param.security_domain = threat @@ -2766,7 +2904,7 @@ action.correlationsearch.label = ESCU - O365 Bypass MFA via Trusted IP - Rule action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. action.notable.param.rule_title = O365 Bypass MFA via Trusted IP action.notable.param.security_domain = threat @@ -2812,7 +2950,7 @@ action.correlationsearch.label = ESCU - O365 Disable MFA - Rule action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1556"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user action.notable.param.rule_title = O365 Disable MFA action.notable.param.security_domain = threat @@ -2938,7 +3076,7 @@ action.correlationsearch.label = ESCU - O365 New Federated Domain Added - Rule action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the addition of a new Federated domain. action.notable.param.rule_title = O365 New Federated Domain Added action.notable.param.security_domain = threat @@ -2984,7 +3122,7 @@ action.correlationsearch.label = ESCU - O365 PST export alert - Rule action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114"], "observable": [{"name": "Source", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content action.notable.param.rule_title = O365 PST export alert action.notable.param.security_domain = threat @@ -3070,7 +3208,7 @@ action.correlationsearch.label = ESCU - O365 Suspicious Rights Delegation - Rule action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. action.notable.param.rule_title = O365 Suspicious Rights Delegation action.notable.param.security_domain = threat @@ -3482,7 +3620,7 @@ action.correlationsearch.label = ESCU - Deprecated - Clients Connecting to Multi action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search. action.notable.param.rule_title = Clients Connecting to Multiple DNS Servers action.notable.param.security_domain = network @@ -3664,7 +3802,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect DNS requests to Phis action.correlationsearch.annotations = {"analytic_story": ["Common Phishing Frameworks"], "cis20": ["CIS 8", "CIS 7"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Delivery", "Command \u0026 Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites. action.notable.param.rule_title = Detect DNS requests to Phishing Sites leveraging EvilGinx2 action.notable.param.security_domain = network @@ -3710,7 +3848,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect Long DNS TXT Record action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses. action.notable.param.rule_title = Detect Long DNS TXT Record Response action.notable.param.security_domain = network @@ -3756,7 +3894,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect Mimikatz Via PowerSh action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. action.notable.param.rule_title = Detect Mimikatz Via PowerShell And EventCode 4703 action.notable.param.security_domain = access @@ -4008,7 +4146,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect USB device insertion action.correlationsearch.annotations = {"analytic_story": ["Data Protection"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework. action.notable.param.rule_title = Detect USB device insertion action.notable.param.security_domain = endpoint @@ -4056,7 +4194,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect web traffic to dynam action.correlationsearch.annotations = {"analytic_story": ["Dynamic DNS"], "cis20": ["CIS 7", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for web connections to dynamic DNS providers. action.notable.param.rule_title = Detect web traffic to dynamic domain providers action.notable.param.security_domain = network @@ -4104,7 +4242,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detection of DNS Tunnels - action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \ NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive. action.notable.param.rule_title = Detection of DNS Tunnels @@ -4151,7 +4289,7 @@ action.correlationsearch.label = ESCU - Deprecated - DNS Query Requests Resolved action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework. action.notable.param.rule_title = DNS Query Requests Resolved by Unauthorized DNS Servers action.notable.param.security_domain = network @@ -4201,7 +4339,7 @@ action.correlationsearch.label = ESCU - Deprecated - DNS record changed - Rule action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day. action.notable.param.rule_title = DNS record changed action.notable.param.security_domain = network @@ -4489,7 +4627,7 @@ action.correlationsearch.label = ESCU - Deprecated - Execution of File With Spac action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view. action.notable.param.rule_title = Execution of File With Spaces Before Extension action.notable.param.security_domain = endpoint @@ -4775,7 +4913,7 @@ action.correlationsearch.label = ESCU - Deprecated - GCP Kubernetes cluster scan action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster action.notable.param.rule_title = GCP Kubernetes cluster scan detection action.notable.param.security_domain = threat @@ -5621,7 +5759,7 @@ action.correlationsearch.label = ESCU - Deprecated - Monitor DNS For Brand Abuse action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Delivery", "Actions on Objectives"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. action.notable.param.rule_title = Monitor DNS For Brand Abuse action.notable.param.security_domain = network @@ -5667,7 +5805,7 @@ action.correlationsearch.label = ESCU - Deprecated - Open Redirect in Splunk Web action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "confidence": 50, "context": ["Unknown"], "cve": ["CVE-2016-4859"], "impact": 50, "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. action.notable.param.rule_title = Open Redirect in Splunk Web action.notable.param.security_domain = network @@ -5713,7 +5851,7 @@ action.correlationsearch.label = ESCU - Deprecated - Osquery pack - ColdRoot det action.correlationsearch.annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Installation", "Command \u0026 Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for ColdRoot events from the osx-attacks osquery pack. action.notable.param.rule_title = Osquery pack - ColdRoot detection action.notable.param.security_domain = threat @@ -5759,7 +5897,7 @@ action.correlationsearch.label = ESCU - Deprecated - Processes created by netsh action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper .dll when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe that are executing commands via the command line. Deprecated because we have another detection of the same type. action.notable.param.rule_title = Processes created by netsh action.notable.param.security_domain = endpoint @@ -5845,7 +5983,7 @@ action.correlationsearch.label = ESCU - Deprecated - Reg exe used to hide files action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for command-line arguments used to hide a file or directory using the reg add command. action.notable.param.rule_title = Reg exe used to hide files directories via registry keys action.notable.param.security_domain = endpoint @@ -5891,7 +6029,7 @@ action.correlationsearch.label = ESCU - Deprecated - Remote Registry Key modific action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search monitors for remote modifications to registry keys. action.notable.param.rule_title = Remote Registry Key modifications action.notable.param.security_domain = endpoint @@ -5937,7 +6075,7 @@ action.correlationsearch.label = ESCU - Deprecated - Scheduled tasks used in Bad action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "cis20": ["CIS 3"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection action.notable.param.rule_title = Scheduled tasks used in BadRabbit ransomware action.notable.param.security_domain = endpoint @@ -5983,7 +6121,7 @@ action.correlationsearch.label = ESCU - Deprecated - Spectre and Meltdown Vulner action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "confidence": 50, "context": ["Unknown"], "cve": ["CVE-2017-5753"], "impact": 50, "kill_chain_phases": ["Exploitation"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities. action.notable.param.rule_title = Spectre and Meltdown Vulnerable Systems action.notable.param.security_domain = endpoint @@ -6029,7 +6167,7 @@ action.correlationsearch.label = ESCU - Deprecated - Splunk Enterprise Informati action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "confidence": 50, "context": ["Unknown"], "cve": ["CVE-2018-11409"], "impact": 50, "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. action.notable.param.rule_title = Splunk Enterprise Information Disclosure action.notable.param.security_domain = network @@ -6075,7 +6213,7 @@ action.correlationsearch.label = ESCU - Deprecated - Suspicious Changes to File action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area. action.notable.param.rule_title = Suspicious Changes to File Associations action.notable.param.security_domain = endpoint @@ -6201,7 +6339,7 @@ action.correlationsearch.label = ESCU - Deprecated - Suspicious Powershell Comma action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Hermetic Wiper"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command action.notable.param.rule_title = Suspicious Powershell Command-Line Arguments action.notable.param.security_domain = endpoint @@ -6367,7 +6505,7 @@ action.correlationsearch.label = ESCU - Deprecated - Unsigned Image Loaded by LS action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects loading of unsigned images by LSASS. Deprecated because too noisy. action.notable.param.rule_title = Unsigned Image Loaded by LSASS action.notable.param.security_domain = endpoint @@ -6453,7 +6591,7 @@ action.correlationsearch.label = ESCU - Deprecated - Web Fraud - Account Harvest action.correlationsearch.annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is used to identify the creation of multiple user accounts using the same email domain name. action.notable.param.rule_title = Web Fraud - Account Harvesting action.notable.param.security_domain = threat @@ -6579,7 +6717,7 @@ action.correlationsearch.label = ESCU - Deprecated - Windows connhost exe starte action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. action.notable.param.rule_title = Windows connhost exe started forcefully action.notable.param.security_domain = endpoint @@ -6625,7 +6763,7 @@ action.correlationsearch.label = ESCU - Deprecated - Windows hosts file modifica action.correlationsearch.annotations = {"analytic_story": ["Host Redirection"], "cis20": ["CIS 3", "CIS 8", "CIS 12"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for modifications to the hosts file on all Windows endpoints across your environment. action.notable.param.rule_title = Windows hosts file modification action.notable.param.security_domain = endpoint @@ -6711,7 +6849,7 @@ action.correlationsearch.label = ESCU - Access LSASS Memory for Dump Creation - action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect memory dumping of the LSASS process. action.notable.param.rule_title = Access LSASS Memory for Dump Creation action.notable.param.security_domain = endpoint @@ -6757,7 +6895,7 @@ action.correlationsearch.label = ESCU - Account Discovery With Net App - Rule action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 10, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Child Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. action.notable.param.rule_title = Account Discovery With Net App action.notable.param.security_domain = endpoint @@ -6803,7 +6941,7 @@ action.correlationsearch.label = ESCU - Active Setup Registry Autostart - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.014", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. action.notable.param.rule_title = Active Setup Registry Autostart action.notable.param.security_domain = endpoint @@ -6889,7 +7027,7 @@ action.correlationsearch.label = ESCU - Add or Set Windows Defender Exclusion - action.correlationsearch.annotations = {"analytic_story": ["Remcos", "Windows Defense Evasion Tactics", "WhisperGate"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify a suspicious process command-line related to Windows Defender exclusion feature. This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products by excluding folder path, file path, process and extensions. From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior. action.notable.param.rule_title = Add or Set Windows Defender Exclusion action.notable.param.security_domain = endpoint @@ -6921,7 +7059,7 @@ action.escu.full_search_name = ESCU - AdsiSearcher Account Discovery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Discovery"] +action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"] action.risk = 1 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}] @@ -6932,10 +7070,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AdsiSearcher Account Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Industroyer2", "Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = AdsiSearcher Account Discovery action.notable.param.security_domain = endpoint @@ -6981,7 +7119,7 @@ action.correlationsearch.label = ESCU - Allow File And Printing Sharing In Firew action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files action.notable.param.rule_title = Allow File And Printing Sharing In Firewall action.notable.param.security_domain = endpoint @@ -7027,7 +7165,7 @@ action.correlationsearch.label = ESCU - Allow Inbound Traffic By Firewall Rule R action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. action.notable.param.rule_title = Allow Inbound Traffic By Firewall Rule Registry action.notable.param.security_domain = endpoint @@ -7073,7 +7211,7 @@ action.correlationsearch.label = ESCU - Allow Inbound Traffic In Firewall Rule - action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. action.notable.param.rule_title = Allow Inbound Traffic In Firewall Rule action.notable.param.security_domain = endpoint @@ -7119,7 +7257,7 @@ action.correlationsearch.label = ESCU - Allow Network Discovery In Firewall - Ru action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. action.notable.param.rule_title = Allow Network Discovery In Firewall action.notable.param.security_domain = endpoint @@ -7165,7 +7303,7 @@ action.correlationsearch.label = ESCU - Allow Operation with Consent Admin - Rul action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. action.notable.param.rule_title = Allow Operation with Consent Admin action.notable.param.security_domain = endpoint @@ -7251,7 +7389,7 @@ action.correlationsearch.label = ESCU - Any Powershell DownloadFile - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. action.notable.param.rule_title = Any Powershell DownloadFile action.notable.param.security_domain = endpoint @@ -7297,7 +7435,7 @@ action.correlationsearch.label = ESCU - Any Powershell DownloadString - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. action.notable.param.rule_title = Any Powershell DownloadString action.notable.param.security_domain = endpoint @@ -7343,7 +7481,7 @@ action.correlationsearch.label = ESCU - Attacker Tools On Endpoint - Rule action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Recon"], "impact": 80, "kill_chain_phases": ["Installation", "Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1036", "T1003", "T1595"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for execution of commonly used attacker tools on an endpoint. action.notable.param.rule_title = Attacker Tools On Endpoint action.notable.param.security_domain = endpoint @@ -7389,7 +7527,7 @@ action.correlationsearch.label = ESCU - Attempt To Add Certificate To Untrusted action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Attempt To Add Certificate To Untrusted Store action.notable.param.rule_title = Attempt To Add Certificate To Untrusted Store action.notable.param.security_domain = endpoint @@ -7435,7 +7573,7 @@ action.correlationsearch.label = ESCU - Attempt To Stop Security Service - Rule action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot", "WhisperGate"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for attempts to stop security-related services on the endpoint. action.notable.param.rule_title = Attempt To Stop Security Service action.notable.param.security_domain = endpoint @@ -7467,7 +7605,7 @@ action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry vi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware", "Windows Registry Abuse"] +action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware", "Windows Registry Abuse", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7478,10 +7616,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware", "Windows Registry Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware", "Windows Registry Abuse", "Industroyer2"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe action.notable.param.security_domain = endpoint @@ -7527,7 +7665,7 @@ action.correlationsearch.label = ESCU - Auto Admin Logon Registry Entry - Rule action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware", "Windows Registry Abuse"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. action.notable.param.rule_title = Auto Admin Logon Registry Entry action.notable.param.security_domain = endpoint @@ -7573,7 +7711,7 @@ action.correlationsearch.label = ESCU - Batch File Write to System32 - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for a batch file (.bat) written to the Windows system directory tree. action.notable.param.rule_title = Batch File Write to System32 action.notable.param.security_domain = endpoint @@ -7619,7 +7757,7 @@ action.correlationsearch.label = ESCU - Bcdedit Command Back To Normal Mode Boot action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. action.notable.param.rule_title = Bcdedit Command Back To Normal Mode Boot action.notable.param.security_domain = endpoint @@ -7665,7 +7803,7 @@ action.correlationsearch.label = ESCU - BCDEdit Failure Recovery Modification - action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. action.notable.param.rule_title = BCDEdit Failure Recovery Modification action.notable.param.security_domain = endpoint @@ -7711,7 +7849,7 @@ action.correlationsearch.label = ESCU - BITS Job Persistence - Rule action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. action.notable.param.rule_title = BITS Job Persistence action.notable.param.security_domain = endpoint @@ -7757,7 +7895,7 @@ action.correlationsearch.label = ESCU - BITSAdmin Download File - Rule action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. action.notable.param.rule_title = BITSAdmin Download File action.notable.param.security_domain = endpoint @@ -7803,7 +7941,7 @@ action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Spli action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. action.notable.param.rule_title = CertUtil Download With URLCache and Split Arguments action.notable.param.security_domain = endpoint @@ -7849,7 +7987,7 @@ action.correlationsearch.label = ESCU - CertUtil Download With VerifyCtl and Spl action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. action.notable.param.rule_title = CertUtil Download With VerifyCtl and Split Arguments action.notable.param.security_domain = endpoint @@ -7895,7 +8033,7 @@ action.correlationsearch.label = ESCU - Certutil exe certificate extraction - Ru action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse", "Living Off The Land"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. action.notable.param.rule_title = Certutil exe certificate extraction action.notable.param.security_domain = endpoint @@ -7941,7 +8079,7 @@ action.correlationsearch.label = ESCU - CertUtil With Decode Argument - Rule action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - `encodehex` and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. action.notable.param.rule_title = CertUtil With Decode Argument action.notable.param.security_domain = endpoint @@ -7987,7 +8125,7 @@ action.correlationsearch.label = ESCU - Change Default File Association - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.001", "T1546"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. action.notable.param.rule_title = Change Default File Association action.notable.param.security_domain = endpoint @@ -8033,7 +8171,7 @@ action.correlationsearch.label = ESCU - Change To Safe Mode With Network Config action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 50, "context": ["Source:Endpoint"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. action.notable.param.rule_title = Change To Safe Mode With Network Config action.notable.param.security_domain = endpoint @@ -8079,7 +8217,7 @@ action.correlationsearch.label = ESCU - CHCP Command Execution - Rule action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect execution of chcp.exe application. this utility is used to change the active code page of the console. This technique was seen in icedid malware to know the locale region/language/country of the compromise host. action.notable.param.rule_title = CHCP Command Execution action.notable.param.security_domain = endpoint @@ -8125,7 +8263,7 @@ action.correlationsearch.label = ESCU - Check Elevated CMD using whoami - Rule action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected machine to check if the running shell cmd process is elevated or not. This TTP is really a good alert for known attacker that recon on the targetted host. This command is not so commonly executed by a normal user or even an admin to check if a process is elevated. action.notable.param.rule_title = Check Elevated CMD using whoami action.notable.param.security_domain = endpoint @@ -8171,7 +8309,7 @@ action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher Ap action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. action.notable.param.rule_title = Clear Unallocated Sector Using Cipher App action.notable.param.security_domain = endpoint @@ -8217,7 +8355,7 @@ action.correlationsearch.label = ESCU - Clop Common Exec Parameter - Rule action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. action.notable.param.rule_title = Clop Common Exec Parameter action.notable.param.security_domain = endpoint @@ -8263,7 +8401,7 @@ action.correlationsearch.label = ESCU - Clop Ransomware Known Service Name - Rul action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry. action.notable.param.rule_title = Clop Ransomware Known Service Name action.notable.param.security_domain = endpoint @@ -8349,7 +8487,7 @@ action.correlationsearch.label = ESCU - CMD Echo Pipe - Escalation - Rule action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003", "T1543.003", "T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. action.notable.param.rule_title = CMD Echo Pipe - Escalation action.notable.param.security_domain = endpoint @@ -8395,7 +8533,7 @@ action.correlationsearch.label = ESCU - Cmdline Tool Not Executed In CMD Shell - action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also typically seen when an adversary is injected into another process performing different discovery techniques. This event stands out as a TTP since these tools are commonly executed with a shell application or Explorer parent, and not by another application. This TTP is a good indicator for an adversary gathering host information, but one possible false positive might be an automated tool used by a system administator. action.notable.param.rule_title = Cmdline Tool Not Executed In CMD Shell action.notable.param.security_domain = endpoint @@ -8441,7 +8579,7 @@ action.correlationsearch.label = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. action.notable.param.rule_title = CMLUA Or CMSTPLUA UAC Bypass action.notable.param.security_domain = endpoint @@ -8489,7 +8627,7 @@ action.correlationsearch.label = ESCU - Cobalt Strike Named Pipes - Rule action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. Cobalt Strike uses named pipes in many ways and has default values used with the Artifact Kit and Malleable C2 Profiles. The following query assists with identifying these default named pipes. Each EDR product presents named pipes a little different. Consider taking the values and generating a query based on the product of choice. \ Upon triage, review the process performing the named pipe. If it is explorer.exe, It is possible it was injected into by another process. Review recent parallel processes to identify suspicious patterns or behaviors. A parallel process may have a network connection, review and follow the connection back to identify any file modifications. action.notable.param.rule_title = Cobalt Strike Named Pipes @@ -8620,7 +8758,7 @@ action.correlationsearch.label = ESCU - Conti Common Exec parameter - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. action.notable.param.rule_title = Conti Common Exec parameter action.notable.param.security_domain = endpoint @@ -8666,7 +8804,7 @@ action.correlationsearch.label = ESCU - Control Loading from World Writable Dire action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze. action.notable.param.rule_title = Control Loading from World Writable Directory action.notable.param.security_domain = endpoint @@ -8712,7 +8850,7 @@ action.correlationsearch.label = ESCU - Create local admin accounts using net ex action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the creation of local administrator accounts using net.exe . action.notable.param.rule_title = Create local admin accounts using net exe action.notable.param.security_domain = endpoint @@ -8758,7 +8896,7 @@ action.correlationsearch.label = ESCU - Create or delete windows shares using ne action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the creation or deletion of hidden shares using net.exe. action.notable.param.rule_title = Create or delete windows shares using net exe action.notable.param.security_domain = endpoint @@ -8804,7 +8942,7 @@ action.correlationsearch.label = ESCU - Create Remote Thread In Shell Applicatio action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect suspicious process injection in command shell. This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as banking trojan. It is really uncommon to have a create remote thread execution in the following application. action.notable.param.rule_title = Create Remote Thread In Shell Application action.notable.param.security_domain = endpoint @@ -8850,7 +8988,7 @@ action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect remote thread creation into LSASS consistent with credential dumping. action.notable.param.rule_title = Create Remote Thread into LSASS action.notable.param.security_domain = endpoint @@ -8896,7 +9034,7 @@ action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Ru action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.notable.param.rule_title = Creation of lsass Dump with Taskmgr action.notable.param.security_domain = endpoint @@ -8942,7 +9080,7 @@ action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. action.notable.param.rule_title = Creation of Shadow Copy action.notable.param.security_domain = endpoint @@ -8988,7 +9126,7 @@ action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and po action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the use of wmic and Powershell to create a shadow copy. action.notable.param.rule_title = Creation of Shadow Copy with wmic and powershell action.notable.param.security_domain = endpoint @@ -9034,7 +9172,7 @@ action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects credential dumping using copy command from a shadow copy. action.notable.param.rule_title = Credential Dumping via Copy Command from Shadow Copy action.notable.param.security_domain = endpoint @@ -9080,7 +9218,7 @@ action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the creation of a symlink to a shadow copy. action.notable.param.rule_title = Credential Dumping via Symlink to Shadow Copy action.notable.param.security_domain = endpoint @@ -9166,7 +9304,7 @@ action.correlationsearch.label = ESCU - Curl Download and Bash Execution - Rule action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of curl on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. action.notable.param.rule_title = Curl Download and Bash Execution action.notable.param.security_domain = endpoint @@ -9212,7 +9350,7 @@ action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. action.notable.param.rule_title = Delete ShadowCopy With PowerShell action.notable.param.security_domain = endpoint @@ -9258,7 +9396,7 @@ action.correlationsearch.label = ESCU - Deleting Of Net Users - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. action.notable.param.rule_title = Deleting Of Net Users action.notable.param.security_domain = endpoint @@ -9304,7 +9442,7 @@ action.correlationsearch.label = ESCU - Deleting Shadow Copies - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. action.notable.param.rule_title = Deleting Shadow Copies action.notable.param.security_domain = endpoint @@ -9350,7 +9488,7 @@ action.correlationsearch.label = ESCU - Detect Activity Related to Pass the Hash action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. action.notable.param.rule_title = Detect Activity Related to Pass the Hash Attacks action.notable.param.security_domain = access @@ -9396,7 +9534,7 @@ action.correlationsearch.label = ESCU - Detect AzureHound Command-Line Arguments action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. action.notable.param.rule_title = Detect AzureHound Command-Line Arguments action.notable.param.security_domain = endpoint @@ -9442,7 +9580,7 @@ action.correlationsearch.label = ESCU - Detect AzureHound File Modifications - R action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. action.notable.param.rule_title = Detect AzureHound File Modifications action.notable.param.security_domain = endpoint @@ -9492,7 +9630,7 @@ action.correlationsearch.label = ESCU - Detect Copy of ShadowCopy with Script Bl action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-36934"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -9540,7 +9678,7 @@ action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for reading lsass memory consistent with credential dumping. action.notable.param.rule_title = Detect Credential Dumping through LSASS access action.notable.param.security_domain = endpoint @@ -9590,7 +9728,7 @@ action.correlationsearch.label = ESCU - Detect Empire with PowerShell Script Blo action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -9722,7 +9860,7 @@ action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. action.notable.param.rule_title = Detect Exchange Web Shell action.notable.param.security_domain = endpoint @@ -9808,7 +9946,7 @@ action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - R action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Detect HTML Help Spawn Child Process action.notable.param.security_domain = endpoint @@ -9854,7 +9992,7 @@ action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - R action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Detect HTML Help URL in Command Line action.notable.param.security_domain = endpoint @@ -9900,7 +10038,7 @@ action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Detect HTML Help Using InfoTech Storage Handlers action.notable.param.security_domain = endpoint @@ -9946,7 +10084,7 @@ action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Ru action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. action.notable.param.rule_title = Detect Mimikatz Using Loaded Images action.notable.param.security_domain = endpoint @@ -9996,7 +10134,7 @@ action.correlationsearch.label = ESCU - Detect Mimikatz With PowerShell Script B action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -10044,7 +10182,7 @@ action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. action.notable.param.rule_title = Detect mshta inline hta execution action.notable.param.security_domain = endpoint @@ -10130,7 +10268,7 @@ action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. action.notable.param.rule_title = Detect MSHTA Url in Command Line action.notable.param.security_domain = endpoint @@ -10176,7 +10314,7 @@ action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for newly created accounts that have been elevated to local administrators. action.notable.param.rule_title = Detect New Local Admin account action.notable.param.security_domain = access @@ -10222,7 +10360,7 @@ action.correlationsearch.label = ESCU - Detect Path Interception By Creation Of action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009", "T1574"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. action.notable.param.rule_title = Detect Path Interception By Creation Of program exe action.notable.param.security_domain = endpoint @@ -10268,7 +10406,7 @@ action.correlationsearch.label = ESCU - Detect processes used for System Network action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 40, "kill_chain_phases": ["Installation", "Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for fast execution of processes used for system network configuration discovery on the endpoint. action.notable.param.rule_title = Detect processes used for System Network Configuration Discovery action.notable.param.security_domain = endpoint @@ -10354,7 +10492,7 @@ action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rul action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Active Directory Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021", "T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. action.notable.param.rule_title = Detect PsExec With accepteula Flag action.notable.param.security_domain = endpoint @@ -10400,7 +10538,7 @@ action.correlationsearch.label = ESCU - Detect RClone Command-Line Usage - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. action.notable.param.rule_title = Detect RClone Command-Line Usage action.notable.param.security_domain = endpoint @@ -10446,7 +10584,7 @@ action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.notable.param.rule_title = Detect Regasm Spawning a Process action.notable.param.security_domain = endpoint @@ -10492,7 +10630,7 @@ action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.notable.param.rule_title = Detect Regasm with Network Connection action.notable.param.security_domain = endpoint @@ -10538,7 +10676,7 @@ action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Argum action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. action.notable.param.rule_title = Detect Regasm with no Command Line Arguments action.notable.param.security_domain = endpoint @@ -10584,7 +10722,7 @@ action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.notable.param.rule_title = Detect Regsvcs Spawning a Process action.notable.param.security_domain = endpoint @@ -10630,7 +10768,7 @@ action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.notable.param.rule_title = Detect Regsvcs with Network Connection action.notable.param.security_domain = Endpoint @@ -10676,7 +10814,7 @@ action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Argu action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.notable.param.rule_title = Detect Regsvcs with No Command Line Arguments action.notable.param.security_domain = endpoint @@ -10724,7 +10862,7 @@ action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypa action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. action.notable.param.rule_title = Detect Regsvr32 Application Control Bypass @@ -10931,7 +11069,7 @@ action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypa action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. action.notable.param.rule_title = Detect Rundll32 Application Control Bypass - advpack action.notable.param.security_domain = endpoint @@ -10977,7 +11115,7 @@ action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypa action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. action.notable.param.rule_title = Detect Rundll32 Application Control Bypass - setupapi action.notable.param.security_domain = endpoint @@ -11023,7 +11161,7 @@ action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypa action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. action.notable.param.rule_title = Detect Rundll32 Application Control Bypass - syssetup action.notable.param.security_domain = endpoint @@ -11069,7 +11207,7 @@ action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - R action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. action.notable.param.rule_title = Detect Rundll32 Inline HTA Execution action.notable.param.security_domain = endpoint @@ -11115,7 +11253,7 @@ action.correlationsearch.label = ESCU - Detect SharpHound Command-Line Arguments action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. action.notable.param.rule_title = Detect SharpHound Command-Line Arguments action.notable.param.security_domain = endpoint @@ -11161,7 +11299,7 @@ action.correlationsearch.label = ESCU - Detect SharpHound File Modifications - R action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. action.notable.param.rule_title = Detect SharpHound File Modifications action.notable.param.security_domain = endpoint @@ -11207,7 +11345,7 @@ action.correlationsearch.label = ESCU - Detect SharpHound Usage - Rule action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. action.notable.param.rule_title = Detect SharpHound Usage action.notable.param.security_domain = endpoint @@ -11253,7 +11391,7 @@ action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script I action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine action.notable.param.rule_title = Detect Use of cmd exe to Launch Script Interpreters action.notable.param.security_domain = endpoint @@ -11309,7 +11447,7 @@ action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistenc action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003", "T1546"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ 1. Filter - WQL Query for the events we want. EventID equals 19 \ @@ -11360,7 +11498,7 @@ action.correlationsearch.label = ESCU - Disable AMSI Through Registry - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. action.notable.param.rule_title = Disable AMSI Through Registry action.notable.param.security_domain = endpoint @@ -11406,7 +11544,7 @@ action.correlationsearch.label = ESCU - Disable Defender AntiVirus Registry - Ru action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.notable.param.rule_title = Disable Defender AntiVirus Registry action.notable.param.security_domain = endpoint @@ -11452,7 +11590,7 @@ action.correlationsearch.label = ESCU - Disable Defender BlockAtFirstSeen Featur action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. action.notable.param.rule_title = Disable Defender BlockAtFirstSeen Feature action.notable.param.security_domain = endpoint @@ -11498,7 +11636,7 @@ action.correlationsearch.label = ESCU - Disable Defender Enhanced Notification - action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. action.notable.param.rule_title = Disable Defender Enhanced Notification action.notable.param.security_domain = endpoint @@ -11544,7 +11682,7 @@ action.correlationsearch.label = ESCU - Disable Defender MpEngine Registry - Rul action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.notable.param.rule_title = Disable Defender MpEngine Registry action.notable.param.security_domain = endpoint @@ -11590,7 +11728,7 @@ action.correlationsearch.label = ESCU - Disable Defender Spynet Reporting - Rule action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. action.notable.param.rule_title = Disable Defender Spynet Reporting action.notable.param.security_domain = endpoint @@ -11636,7 +11774,7 @@ action.correlationsearch.label = ESCU - Disable Defender Submit Samples Consent action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. action.notable.param.rule_title = Disable Defender Submit Samples Consent Feature action.notable.param.security_domain = endpoint @@ -11682,7 +11820,7 @@ action.correlationsearch.label = ESCU - Disable ETW Through Registry - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. action.notable.param.rule_title = Disable ETW Through Registry action.notable.param.security_domain = endpoint @@ -11728,7 +11866,7 @@ action.correlationsearch.label = ESCU - Disable Logs Using WevtUtil - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070", "T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. action.notable.param.rule_title = Disable Logs Using WevtUtil action.notable.param.security_domain = endpoint @@ -11774,7 +11912,7 @@ action.correlationsearch.label = ESCU - Disable Registry Tool - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.notable.param.rule_title = Disable Registry Tool action.notable.param.security_domain = endpoint @@ -11820,7 +11958,7 @@ action.correlationsearch.label = ESCU - Disable Schedule Task - Rule action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. action.notable.param.rule_title = Disable Schedule Task action.notable.param.security_domain = endpoint @@ -11866,7 +12004,7 @@ action.correlationsearch.label = ESCU - Disable Security Logs Using MiniNt Regis action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log action.notable.param.rule_title = Disable Security Logs Using MiniNt Registry action.notable.param.security_domain = endpoint @@ -11912,7 +12050,7 @@ action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.notable.param.rule_title = Disable Show Hidden Files action.notable.param.security_domain = endpoint @@ -11958,7 +12096,7 @@ action.correlationsearch.label = ESCU - Disable UAC Remote Restriction - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. action.notable.param.rule_title = Disable UAC Remote Restriction action.notable.param.security_domain = endpoint @@ -12004,7 +12142,7 @@ action.correlationsearch.label = ESCU - Disable Windows App Hotkeys - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems. action.notable.param.rule_title = Disable Windows App Hotkeys action.notable.param.security_domain = endpoint @@ -12050,7 +12188,7 @@ action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Ru action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. action.notable.param.rule_title = Disable Windows Behavior Monitoring action.notable.param.security_domain = endpoint @@ -12096,7 +12234,7 @@ action.correlationsearch.label = ESCU - Disable Windows SmartScreen Protection - action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. action.notable.param.rule_title = Disable Windows SmartScreen Protection action.notable.param.security_domain = endpoint @@ -12142,7 +12280,7 @@ action.correlationsearch.label = ESCU - Disabled Kerberos Pre-Authentication Dis action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. action.notable.param.rule_title = Disabled Kerberos Pre-Authentication Discovery With Get-ADUser action.notable.param.security_domain = endpoint @@ -12188,7 +12326,7 @@ action.correlationsearch.label = ESCU - Disabled Kerberos Pre-Authentication Dis action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. action.notable.param.rule_title = Disabled Kerberos Pre-Authentication Discovery With PowerView action.notable.param.security_domain = endpoint @@ -12234,7 +12372,7 @@ action.correlationsearch.label = ESCU - Disabling CMD Application - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. action.notable.param.rule_title = Disabling CMD Application action.notable.param.security_domain = endpoint @@ -12280,7 +12418,7 @@ action.correlationsearch.label = ESCU - Disabling ControlPanel - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. action.notable.param.rule_title = Disabling ControlPanel action.notable.param.security_domain = endpoint @@ -12326,7 +12464,7 @@ action.correlationsearch.label = ESCU - Disabling Defender Services - Rule action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.notable.param.rule_title = Disabling Defender Services action.notable.param.security_domain = endpoint @@ -12372,7 +12510,7 @@ action.correlationsearch.label = ESCU - Disabling Firewall with Netsh - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. action.notable.param.rule_title = Disabling Firewall with Netsh action.notable.param.security_domain = endpoint @@ -12418,7 +12556,7 @@ action.correlationsearch.label = ESCU - Disabling FolderOptions Windows Feature action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. action.notable.param.rule_title = Disabling FolderOptions Windows Feature action.notable.param.security_domain = endpoint @@ -12464,7 +12602,7 @@ action.correlationsearch.label = ESCU - Disabling Net User Account - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. action.notable.param.rule_title = Disabling Net User Account action.notable.param.security_domain = endpoint @@ -12510,7 +12648,7 @@ action.correlationsearch.label = ESCU - Disabling NoRun Windows App - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. action.notable.param.rule_title = Disabling NoRun Windows App action.notable.param.security_domain = endpoint @@ -12556,7 +12694,7 @@ action.correlationsearch.label = ESCU - Disabling Remote User Account Control - action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). action.notable.param.rule_title = Disabling Remote User Account Control action.notable.param.security_domain = endpoint @@ -12602,7 +12740,7 @@ action.correlationsearch.label = ESCU - Disabling SystemRestore In Registry - Ru action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. action.notable.param.rule_title = Disabling SystemRestore In Registry action.notable.param.security_domain = endpoint @@ -12648,7 +12786,7 @@ action.correlationsearch.label = ESCU - Disabling Task Manager - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. action.notable.param.rule_title = Disabling Task Manager action.notable.param.security_domain = endpoint @@ -12694,7 +12832,7 @@ action.correlationsearch.label = ESCU - DLLHost with no Command Line Arguments w action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = DLLHost with no Command Line Arguments with Network action.notable.param.security_domain = endpoint @@ -12740,7 +12878,7 @@ action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Ru action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.notable.param.rule_title = DNS Exfiltration Using Nslookup App action.notable.param.security_domain = endpoint @@ -12826,7 +12964,7 @@ action.correlationsearch.label = ESCU - Domain Account Discovery With Net App - action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Account Discovery With Net App action.notable.param.security_domain = endpoint @@ -12872,7 +13010,7 @@ action.correlationsearch.label = ESCU - Domain Account Discovery with Wmic - Rul action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Account Discovery with Wmic action.notable.param.security_domain = endpoint @@ -12918,7 +13056,7 @@ action.correlationsearch.label = ESCU - Domain Controller Discovery with Nltest action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Controller Discovery with Nltest action.notable.param.security_domain = endpoint @@ -13004,7 +13142,7 @@ action.correlationsearch.label = ESCU - Domain Group Discovery with Adsisearcher action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Group Discovery with Adsisearcher action.notable.param.security_domain = endpoint @@ -13170,7 +13308,7 @@ action.correlationsearch.label = ESCU - Download Files Using Telegram - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. action.notable.param.rule_title = Download Files Using Telegram action.notable.param.security_domain = endpoint @@ -13266,7 +13404,7 @@ action.correlationsearch.label = ESCU - DSQuery Domain Discovery - Rule action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery", "Active Directory Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "dsquery.exe" and its parent process.\ @@ -13303,7 +13441,7 @@ action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land"] +action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -13314,10 +13452,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect the usage of comsvcs.dll for dumping the lsass process. action.notable.param.rule_title = Dump LSASS via comsvcs DLL action.notable.param.security_domain = endpoint @@ -13365,7 +13503,7 @@ action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (original_file_name=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. action.notable.param.rule_title = Dump LSASS via procdump @@ -13412,7 +13550,7 @@ action.correlationsearch.label = ESCU - Elevated Group Discovery With Net - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. action.notable.param.rule_title = Elevated Group Discovery With Net action.notable.param.security_domain = endpoint @@ -13498,7 +13636,7 @@ action.correlationsearch.label = ESCU - Elevated Group Discovery With Wmic - Rul action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. action.notable.param.rule_title = Elevated Group Discovery With Wmic action.notable.param.security_domain = endpoint @@ -13544,7 +13682,7 @@ action.correlationsearch.label = ESCU - Enable RDP In Other Port Number - Rule action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. action.notable.param.rule_title = Enable RDP In Other Port Number action.notable.param.security_domain = endpoint @@ -13590,7 +13728,7 @@ action.correlationsearch.label = ESCU - Enable WDigest UseLogonCredential Regist action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. action.notable.param.rule_title = Enable WDigest UseLogonCredential Registry action.notable.param.security_domain = endpoint @@ -13636,7 +13774,7 @@ action.correlationsearch.label = ESCU - Enumerate Users Local Group Using Telegr action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. action.notable.param.rule_title = Enumerate Users Local Group Using Telegram action.notable.param.security_domain = endpoint @@ -13722,7 +13860,7 @@ action.correlationsearch.label = ESCU - ETW Registry Disabled - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.006", "T1127", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. action.notable.param.rule_title = ETW Registry Disabled action.notable.param.security_domain = endpoint @@ -13768,7 +13906,7 @@ action.correlationsearch.label = ESCU - Eventvwr UAC Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID", "Living Off The Land", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. action.notable.param.rule_title = Eventvwr UAC Bypass action.notable.param.security_domain = endpoint @@ -13814,7 +13952,7 @@ action.correlationsearch.label = ESCU - Excel Spawning PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. action.notable.param.rule_title = Excel Spawning PowerShell action.notable.param.security_domain = endpoint @@ -13860,7 +13998,7 @@ action.correlationsearch.label = ESCU - Excel Spawning Windows Script Host - Rul action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. action.notable.param.rule_title = Excel Spawning Windows Script Host action.notable.param.security_domain = endpoint @@ -13986,7 +14124,7 @@ action.correlationsearch.label = ESCU - Excessive File Deletion In WinDefender F action.correlationsearch.annotations = {"analytic_story": ["WhisperGate"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "deleted_files", "role": ["Target"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify excessive file deletion events in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which adversaries abused Nirsofts advancedrun.exe to gain administrative privilege to then execute PowerShell commands to delete files within the Windows Defender application folder. This behavior is a good indicator the offending process is trying to corrupt a Windows Defender installation. action.notable.param.rule_title = Excessive File Deletion In WinDefender Folder action.notable.param.security_domain = endpoint @@ -14338,7 +14476,7 @@ action.escu.full_search_name = ESCU - Executable File Written in Administrative action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Data Destruction", "Active Directory Lateral Movement", "Trickbot", "Hermetic Wiper"] +action.escu.analytic_story = ["Data Destruction", "Active Directory Lateral Movement", "Trickbot", "Hermetic Wiper", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] @@ -14349,10 +14487,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Executable File Written in Administrative SMB Share - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Active Directory Lateral Movement", "Trickbot", "Hermetic Wiper"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Active Directory Lateral Movement", "Trickbot", "Hermetic Wiper", "Industroyer2"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network. action.notable.param.rule_title = Executable File Written in Administrative SMB Share action.notable.param.security_domain = endpoint @@ -14384,7 +14522,7 @@ action.escu.full_search_name = ESCU - Executables Or Script Creation In Suspicio action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper"] +action.escu.analytic_story = ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] @@ -14395,10 +14533,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Executables Or Script Creation In Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. action.notable.param.rule_title = Executables Or Script Creation In Suspicious Path action.notable.param.security_domain = endpoint @@ -14444,7 +14582,7 @@ action.correlationsearch.label = ESCU - Execute Javascript With Jscript COM CLSI action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.005"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. action.notable.param.rule_title = Execute Javascript With Jscript COM CLSID action.notable.param.security_domain = endpoint @@ -14490,7 +14628,7 @@ action.correlationsearch.label = ESCU - Execution of File with Multiple Extensio action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process", "role": ["Parent Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. action.notable.param.rule_title = Execution of File with Multiple Extensions action.notable.param.security_domain = endpoint @@ -14536,7 +14674,7 @@ action.correlationsearch.label = ESCU - Extraction of Registry Hives - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. action.notable.param.rule_title = Extraction of Registry Hives action.notable.param.security_domain = endpoint @@ -14582,7 +14720,7 @@ action.correlationsearch.label = ESCU - File with Samsam Extension - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for file writes with extensions consistent with a SamSam ransomware attack. action.notable.param.rule_title = File with Samsam Extension action.notable.param.security_domain = endpoint @@ -14676,7 +14814,7 @@ action.correlationsearch.label = ESCU - FodHelper UAC Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1548.002", "T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with the highest privilege. \ 1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\ 1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\ @@ -14726,7 +14864,7 @@ action.correlationsearch.label = ESCU - Fsutil Zeroing File - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. action.notable.param.rule_title = Fsutil Zeroing File action.notable.param.security_domain = endpoint @@ -14932,7 +15070,7 @@ action.correlationsearch.label = ESCU - Get ADUserResultantPasswordPolicy with P action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADUserResultantPasswordPolicy with Powershell action.notable.param.security_domain = endpoint @@ -14978,7 +15116,7 @@ action.correlationsearch.label = ESCU - Get ADUserResultantPasswordPolicy with P action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADUserResultantPasswordPolicy with Powershell Script Block action.notable.param.security_domain = endpoint @@ -15024,7 +15162,7 @@ action.correlationsearch.label = ESCU - Get DomainPolicy with Powershell - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainPolicy with Powershell action.notable.param.security_domain = endpoint @@ -15070,7 +15208,7 @@ action.correlationsearch.label = ESCU - Get DomainPolicy with Powershell Script action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainPolicy with Powershell Script Block action.notable.param.security_domain = endpoint @@ -15116,7 +15254,7 @@ action.correlationsearch.label = ESCU - Get-DomainTrust with PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. action.notable.param.rule_title = Get-DomainTrust with PowerShell action.notable.param.security_domain = endpoint @@ -15166,7 +15304,7 @@ action.correlationsearch.label = ESCU - Get-DomainTrust with PowerShell Script B action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -15214,7 +15352,7 @@ action.correlationsearch.label = ESCU - Get DomainUser with PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainUser with PowerShell action.notable.param.security_domain = endpoint @@ -15260,7 +15398,7 @@ action.correlationsearch.label = ESCU - Get DomainUser with PowerShell Script Bl action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainUser with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -15306,7 +15444,7 @@ action.correlationsearch.label = ESCU - Get-ForestTrust with PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. action.notable.param.rule_title = Get-ForestTrust with PowerShell action.notable.param.security_domain = endpoint @@ -15356,7 +15494,7 @@ action.correlationsearch.label = ESCU - Get-ForestTrust with PowerShell Script B action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -15728,7 +15866,7 @@ action.correlationsearch.label = ESCU - GetDomainComputer with PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetDomainComputer with PowerShell action.notable.param.security_domain = endpoint @@ -15774,7 +15912,7 @@ action.correlationsearch.label = ESCU - GetDomainComputer with PowerShell Script action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetDomainComputer with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -15860,7 +15998,7 @@ action.correlationsearch.label = ESCU - GetDomainController with PowerShell Scri action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetDomainController with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -15906,7 +16044,7 @@ action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetDomainGroup with PowerShell action.notable.param.security_domain = endpoint @@ -15952,7 +16090,7 @@ action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell Script Bl action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetDomainGroup with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -16158,7 +16296,7 @@ action.correlationsearch.label = ESCU - GetWmiObject Ds Computer with PowerShell action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject Ds Computer with PowerShell action.notable.param.security_domain = endpoint @@ -16204,7 +16342,7 @@ action.correlationsearch.label = ESCU - GetWmiObject Ds Computer with PowerShell action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject Ds Computer with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -16250,7 +16388,7 @@ action.correlationsearch.label = ESCU - GetWmiObject Ds Group with PowerShell - action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject Ds Group with PowerShell action.notable.param.security_domain = endpoint @@ -16296,7 +16434,7 @@ action.correlationsearch.label = ESCU - GetWmiObject Ds Group with PowerShell Sc action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject Ds Group with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -16342,7 +16480,7 @@ action.correlationsearch.label = ESCU - GetWmiObject DS User with PowerShell - R action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject DS User with PowerShell action.notable.param.security_domain = endpoint @@ -16388,7 +16526,7 @@ action.correlationsearch.label = ESCU - GetWmiObject DS User with PowerShell Scr action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject DS User with PowerShell Script Block action.notable.param.security_domain = endpoint @@ -16514,7 +16652,7 @@ action.correlationsearch.label = ESCU - GPUpdate with no Command Line Arguments action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "connection_to_CNC", "role": ["Other"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = GPUpdate with no Command Line Arguments with Network action.notable.param.security_domain = endpoint @@ -16560,7 +16698,7 @@ action.correlationsearch.label = ESCU - Hide User Account From Sign-In Screen - action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Windows Registry Abuse"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. action.notable.param.rule_title = Hide User Account From Sign-In Screen action.notable.param.security_domain = endpoint @@ -16606,7 +16744,7 @@ action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. action.notable.param.rule_title = Hiding Files And Directories With Attrib exe action.notable.param.security_domain = endpoint @@ -16792,7 +16930,7 @@ action.correlationsearch.label = ESCU - Icacls Deny Command - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. action.notable.param.rule_title = Icacls Deny Command action.notable.param.security_domain = endpoint @@ -16838,7 +16976,7 @@ action.correlationsearch.label = ESCU - ICACLS Grant Command - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files. action.notable.param.rule_title = ICACLS Grant Command action.notable.param.security_domain = endpoint @@ -16910,7 +17048,7 @@ action.escu.full_search_name = ESCU - Impacket Lateral Movement Commandline Para action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement", "WhisperGate"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] @@ -16921,10 +17059,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Impacket Lateral Movement Commandline Parameters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "WhisperGate"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002", "T1021.003", "T1047", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002", "T1021.003", "T1047", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the presence of suspicious commandline parameters typically present when using Impacket tools. Impacket is a collection of python classes meant to be used with Microsoft network protocols. There are multiple scripts that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` and `atexec.py` used to execute commands on remote endpoints. By default, these scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution. action.notable.param.rule_title = Impacket Lateral Movement Commandline Parameters action.notable.param.security_domain = endpoint @@ -16970,7 +17108,7 @@ action.correlationsearch.label = ESCU - Interactive Session on Remote Endpoint w action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the usage of the `Enter-PSSession`. This commandlet can be used to open an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution. action.notable.param.rule_title = Interactive Session on Remote Endpoint with PowerShell action.notable.param.security_domain = endpoint @@ -17016,7 +17154,7 @@ action.correlationsearch.label = ESCU - Java Class File download by Java User Ag action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "confidence": 50, "context": ["Scope:Network"], "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "http_user_agent", "role": ["Other"], "type": "Other"}, {"name": "http_method", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a Java user agent performing a GET request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). action.notable.param.rule_title = Java Class File download by Java User Agent action.notable.param.security_domain = network @@ -17062,7 +17200,7 @@ action.correlationsearch.label = ESCU - Java Writing JSP File - Rule action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-22965"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. action.notable.param.rule_title = Java Writing JSP File action.notable.param.security_domain = endpoint @@ -17108,7 +17246,7 @@ action.correlationsearch.label = ESCU - Jscript Execution Using Cscript App - Ru action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts to check further anomalies within the network action.notable.param.rule_title = Jscript Execution Using Cscript App action.notable.param.security_domain = endpoint @@ -17154,7 +17292,7 @@ action.correlationsearch.label = ESCU - Kerberoasting spn request with RC4 encry action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Active Directory Kerberos Attacks", "Hermetic Wiper"], "cis20": ["CIS 8", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options. action.notable.param.rule_title = Kerberoasting spn request with RC4 encryption action.notable.param.security_domain = endpoint @@ -17200,7 +17338,7 @@ action.correlationsearch.label = ESCU - Kerberos Pre-Authentication Flag Disable action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic leverages Windows Security Event 4738, `A user account was changed`, to identify a change performed on a domain user object that disables Kerberos Pre-Authentication. Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges. action.notable.param.rule_title = Kerberos Pre-Authentication Flag Disabled in UserAccountControl action.notable.param.security_domain = endpoint @@ -17246,7 +17384,7 @@ action.correlationsearch.label = ESCU - Kerberos Pre-Authentication Flag Disable action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account. With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges. action.notable.param.rule_title = Kerberos Pre-Authentication Flag Disabled with PowerShell action.notable.param.security_domain = endpoint @@ -17292,7 +17430,7 @@ action.correlationsearch.label = ESCU - Kerberos Service Ticket Request Using RC action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential Kerberos Service Ticket request related to a Golden Ticket attack. Adversaries who have obtained the Krbtgt account NTLM password hash may forge a Kerberos Granting Ticket (TGT) to obtain unrestricted access to an Active Directory environment. Armed with a Golden Ticket, attackers can request service tickets to move laterally and execute code on remote systems. Looking for Kerberos Service Ticket requests using the legacy RC4 encryption mechanism could represent the second stage of a Golden Ticket attack. RC4 usage should be rare on a modern network since Windows Vista & Windows Sever 2008 and newer support AES Kerberos encryption.\ Defenders should note that if an attacker does not leverage the NTLM password hash but rather the AES key to create a golden ticket, this detection may be bypassed. action.notable.param.rule_title = Kerberos Service Ticket Request Using RC4 Encryption action.notable.param.security_domain = endpoint @@ -17338,7 +17476,7 @@ action.correlationsearch.label = ESCU - Kerberos TGT Request Using RC4 Encryptio action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic leverages Event 4768, A Kerberos authentication ticket (TGT) was requested, to identify a TGT request with encryption type 0x17, or RC4-HMAC. This encryption type is no longer utilized by newer systems and could represent evidence of an OverPass The Hash attack. Similar to Pass The Hash, OverPass The Hash is a form of credential theft that allows adversaries to move laterally or consume resources in a target network. Leveraging this attack, an adversary who has stolen the NTLM hash of a valid domain account is able to authenticate to the Kerberos Distribution Center(KDC) on behalf of the legitimate account and obtain a Kerberos TGT ticket. Depending on the privileges of the compromised account, this ticket may be used to obtain unauthorized access to systems and other network resources. action.notable.param.rule_title = Kerberos TGT Request Using RC4 Encryption action.notable.param.security_domain = endpoint @@ -17424,7 +17562,7 @@ action.correlationsearch.label = ESCU - Known Services Killed by Ransomware - Ru action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "BlackMatter Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Message", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. action.notable.param.rule_title = Known Services Killed by Ransomware action.notable.param.security_domain = endpoint @@ -17696,7 +17834,7 @@ action.escu.full_search_name = ESCU - Linux DD File Overwrite - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Data Destruction"] +action.escu.analytic_story = ["Data Destruction", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = A commandline $process$ executed on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] @@ -17707,10 +17845,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Linux DD File Overwrite - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Destruction"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Industroyer2"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability, services and many more. This is also used to destroy data where it make the file irrecoverable by forensic techniques through overwriting files, data or local and remote drives. action.notable.param.rule_title = Linux DD File Overwrite action.notable.param.security_domain = endpoint @@ -17796,7 +17934,7 @@ action.correlationsearch.label = ESCU - Linux Deletion Of Init Daemon Script - R action.correlationsearch.annotations = {"analytic_story": ["AcidRain"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a deletion of init daemon script in a linux machine. daemon script that place in /etc/init.d/ is a directory that can start and stop some daemon services in linux machines. attacker may delete or modify daemon script to impair some security features or act as defense evasion in a compromised linux machine. This TTP can be also a good indicator of a malware trying to wipe or delete several files in compromised host as part of its destructive payload like what acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. action.notable.param.rule_title = Linux Deletion Of Init Daemon Script action.notable.param.security_domain = endpoint @@ -17842,7 +17980,7 @@ action.correlationsearch.label = ESCU - Linux Deletion Of Services - Rule action.correlationsearch.annotations = {"analytic_story": ["AcidRain"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a deletion of services in a linux machine. attacker may delete or modify services to impair some security features or act as defense evasion in a compromised linux machine. This TTP can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. action.notable.param.rule_title = Linux Deletion Of Services action.notable.param.security_domain = endpoint @@ -18307,8 +18445,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. action.escu.known_false_positives = administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed. -action.escu.creation_date = 2022-04-05 -action.escu.modification_date = 2022-04-05 +action.escu.creation_date = 2022-04-30 +action.escu.modification_date = 2022-04-30 action.escu.confidence = high action.escu.full_search_name = ESCU - Linux Iptables Firewall Modification - Rule action.escu.search_type = detection @@ -18317,7 +18455,7 @@ action.escu.providing_technologies = [] action.escu.analytic_story = ["Cyclops BLink"] action.risk = 1 action.risk.param._risk_message = A commandline $process$ that may modify iptables firewall on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param._risk_score = 0 action.risk.param.verbose = 0 cron_schedule = 0 * * * * @@ -18325,7 +18463,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Linux Iptables Firewall Modification - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cyclops BLink"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Cyclops BLink"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18336,7 +18474,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter` [ESCU - Linux Java Spawning Shell - Rule] action.escu = 0 @@ -18368,7 +18506,7 @@ action.correlationsearch.label = ESCU - Linux Java Spawning Shell - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Log4Shell CVE-2021-44228", "Spring4Shell CVE-2022-22965"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the process name of Java, Apache, or Tomcat spawning a Linux shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh', "tcsh', "ion", "eshell". Upon triage, review parallel processes and command-line arguments to determine legitimacy. action.notable.param.rule_title = Linux Java Spawning Shell action.notable.param.security_domain = endpoint @@ -18384,41 +18522,35 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java OR Processes.parent_process_name=apache OR Processes.parent_process_name=tomcat `linux_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_spawning_shell_filter` -[ESCU - Linux Kworker Process CommandLine - Rule] +[ESCU - Linux Kworker Process In Writable Process Path - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common name of kernel thread in linux process. So it is really a suspicious event a normal user process contain this process commandline. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. +description = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common names of kernel threads in linux process. This hunting detections can lead to investigate process contains process path in writable directory in linux like /home/, /var/log and /tmp/. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.004", "T1036"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common name of kernel thread in linux process. So it is really a suspicious event a normal user process contain this process commandline. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. +action.escu.eli5 = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common names of kernel threads in linux process. This hunting detections can lead to investigate process contains process path in writable directory in linux like /home/, /var/log and /tmp/. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. action.escu.known_false_positives = unknown -action.escu.creation_date = 2022-04-05 -action.escu.modification_date = 2022-04-05 +action.escu.creation_date = 2022-04-30 +action.escu.modification_date = 2022-04-30 action.escu.confidence = high -action.escu.full_search_name = ESCU - Linux Kworker Process CommandLine - Rule +action.escu.full_search_name = ESCU - Linux Kworker Process In Writable Process Path - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cyclops BLink"] action.risk = 1 action.risk.param._risk_message = a $process_name$ with kworker commandline in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] action.risk.param._risk_score = 0 action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Linux Kworker Process CommandLine - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cyclops BLink"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.004", "T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.label = ESCU - Linux Kworker Process In Writable Process Path - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cyclops BLink"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.004", "T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = [] -action.notable.param.rule_description = This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common name of kernel thread in linux process. So it is really a suspicious event a normal user process contain this process commandline. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. -action.notable.param.rule_title = Linux Kworker Process CommandLine -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -18428,7 +18560,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*[kworker/*" OR Processes.parent_process = "*[kworker/*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_commandline_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter` [ESCU - Linux NOPASSWD Entry In Sudoers File - Rule] action.escu = 0 @@ -18500,7 +18632,7 @@ action.correlationsearch.label = ESCU - Linux pkexec Privilege Escalation - Rule action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-4034"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `pkexec` spawning with no command-line arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 (PwnKit) which is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system. action.notable.param.rule_title = Linux pkexec Privilege Escalation action.notable.param.security_domain = endpoint @@ -18866,7 +18998,7 @@ action.correlationsearch.label = ESCU - Linux Preload Hijack Library Calls - Rul action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.006", "T1574"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious command that may hijack a library function in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain privileges and persist on the machine. This detection pertains to loading a dll to hijack or hook a library function of specific program using LD_PRELOAD command. action.notable.param.rule_title = Linux Preload Hijack Library Calls action.notable.param.security_domain = endpoint @@ -19082,46 +19214,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = setcap OR Processes.process = "*setcap *") AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_setcap_utility_filter` -[ESCU - Linux Stdout Redirection To Dev Null File - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -action.escu.known_false_positives = unknown -action.escu.creation_date = 2022-04-05 -action.escu.modification_date = 2022-04-05 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Linux Stdout Redirection To Dev Null File - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cyclops BLink"] -action.risk = 1 -action.risk.param._risk_message = a commandline $process$ that redirect stdout to dev/null in $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Linux Stdout Redirection To Dev Null File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cyclops BLink"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*&>/dev/null*" by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stdout_redirection_to_dev_null_file_filter` - [ESCU - Linux Sudo OR Su Execution - Rule] action.escu = 0 action.escu.enabled = 1 @@ -19218,7 +19310,7 @@ action.escu.full_search_name = ESCU - Linux System Network Discovery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Network Discovery"] +action.escu.analytic_story = ["Network Discovery", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = A commandline $process$ executed on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}] @@ -19229,7 +19321,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Linux System Network Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Network Discovery"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Network Discovery", "Industroyer2"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19312,7 +19404,7 @@ action.correlationsearch.label = ESCU - Loading Of Dynwrapx Module - Rule action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. action.notable.param.rule_title = Loading Of Dynwrapx Module action.notable.param.security_domain = endpoint @@ -19438,7 +19530,7 @@ action.correlationsearch.label = ESCU - Log4Shell CVE-2021-44228 Exploitation - action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "affected_systems", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks. action.notable.param.rule_title = Log4Shell CVE-2021-44228 Exploitation action.notable.param.security_domain = endpoint @@ -19484,7 +19576,7 @@ action.correlationsearch.label = ESCU - Logon Script Event Trigger Execution - R action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037", "T1037.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. action.notable.param.rule_title = Logon Script Event Trigger Execution action.notable.param.security_domain = endpoint @@ -19530,7 +19622,7 @@ action.correlationsearch.label = ESCU - MacOS LOLbin - Rule action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059.004", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time. action.notable.param.rule_title = MacOS LOLbin action.notable.param.security_domain = endpoint @@ -19576,7 +19668,7 @@ action.correlationsearch.label = ESCU - MacOS plutil - Rule action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.011"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line arguments. Plist files in auto-run locations are executed upon user logon or system startup. action.notable.param.rule_title = MacOS plutil action.notable.param.security_domain = endpoint @@ -19622,7 +19714,7 @@ action.correlationsearch.label = ESCU - Mailsniper Invoke functions - Rule action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. action.notable.param.rule_title = Mailsniper Invoke functions action.notable.param.security_domain = endpoint @@ -19668,7 +19760,7 @@ action.correlationsearch.label = ESCU - Malicious InProcServer32 Modification - action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. action.notable.param.rule_title = Malicious InProcServer32 Modification action.notable.param.security_domain = endpoint @@ -19714,7 +19806,7 @@ action.correlationsearch.label = ESCU - Malicious Powershell Executed As A Servi action.correlationsearch.annotations = {"analytic_story": ["Malicious Powershell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. action.notable.param.rule_title = Malicious Powershell Executed As A Service action.notable.param.security_domain = endpoint @@ -19806,7 +19898,7 @@ action.correlationsearch.label = ESCU - Malicious PowerShell Process - Execution action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy. action.notable.param.rule_title = Malicious PowerShell Process - Execution Policy Bypass action.notable.param.security_domain = endpoint @@ -19852,7 +19944,7 @@ action.correlationsearch.label = ESCU - Malicious PowerShell Process With Obfusc action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. action.notable.param.rule_title = Malicious PowerShell Process With Obfuscation Techniques action.notable.param.security_domain = endpoint @@ -19898,7 +19990,7 @@ action.correlationsearch.label = ESCU - Mimikatz PassTheTicket CommandLine Param action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic. action.notable.param.rule_title = Mimikatz PassTheTicket CommandLine Parameters action.notable.param.security_domain = endpoint @@ -19944,7 +20036,7 @@ action.correlationsearch.label = ESCU - Mmc LOLBAS Execution Process Spawn - Rul action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. action.notable.param.rule_title = Mmc LOLBAS Execution Process Spawn action.notable.param.security_domain = endpoint @@ -19990,7 +20082,7 @@ action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. action.notable.param.rule_title = Modification Of Wallpaper action.notable.param.security_domain = endpoint @@ -20076,7 +20168,7 @@ action.correlationsearch.label = ESCU - Monitor Registry Keys for Print Monitors action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010", "T1547"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. action.notable.param.rule_title = Monitor Registry Keys for Print Monitors action.notable.param.security_domain = endpoint @@ -20202,7 +20294,7 @@ action.correlationsearch.label = ESCU - MSBuild Suspicious Spawned By Script Pro action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "confidence": 70, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1127"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. action.notable.param.rule_title = MSBuild Suspicious Spawned By Script Process action.notable.param.security_domain = endpoint @@ -20248,7 +20340,7 @@ action.correlationsearch.label = ESCU - Mshta spawning Rundll32 OR Regsvr32 Proc action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. action.notable.param.rule_title = Mshta spawning Rundll32 OR Regsvr32 Process action.notable.param.security_domain = endpoint @@ -20294,7 +20386,7 @@ action.correlationsearch.label = ESCU - MSHTML Module Load in Office Product - R action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. action.notable.param.rule_title = MSHTML Module Load in Office Product action.notable.param.security_domain = endpoint @@ -20390,7 +20482,7 @@ action.correlationsearch.label = ESCU - Msmpeng Application DLL Side Loading - R action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine action.notable.param.rule_title = Msmpeng Application DLL Side Loading action.notable.param.security_domain = endpoint @@ -20706,7 +20798,7 @@ action.correlationsearch.label = ESCU - NET Profiler UAC bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. action.notable.param.rule_title = NET Profiler UAC bypass action.notable.param.security_domain = endpoint @@ -20912,7 +21004,7 @@ action.correlationsearch.label = ESCU - Nishang PowershellTCPOneLine - Rule action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang. Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. action.notable.param.rule_title = Nishang PowershellTCPOneLine action.notable.param.security_domain = endpoint @@ -20937,8 +21029,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Administrators may use nltest for troubleshooting purposes, otherwise, rarely used. -action.escu.creation_date = 2021-01-25 -action.escu.modification_date = 2021-01-25 +action.escu.creation_date = 2022-04-18 +action.escu.modification_date = 2022-04-18 action.escu.confidence = high action.escu.full_search_name = ESCU - NLTest Domain Trust Discovery - Rule action.escu.search_type = detection @@ -20958,7 +21050,7 @@ action.correlationsearch.label = ESCU - NLTest Domain Trust Discovery - Rule action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID", "Active Directory Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. action.notable.param.rule_title = NLTest Domain Trust Discovery action.notable.param.security_domain = endpoint @@ -20972,7 +21064,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter` [ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule] action.escu = 0 @@ -21088,7 +21180,7 @@ action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. @@ -21136,7 +21228,7 @@ action.correlationsearch.label = ESCU - Office Application Drop Executable - Rul action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application action.notable.param.rule_title = Office Application Drop Executable action.notable.param.security_domain = endpoint @@ -21182,7 +21274,7 @@ action.correlationsearch.label = ESCU - Office Application Spawn Regsvr32 proces action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack vector to initially infect the machines. action.notable.param.rule_title = Office Application Spawn Regsvr32 process action.notable.param.security_domain = endpoint @@ -21228,7 +21320,7 @@ action.correlationsearch.label = ESCU - Office Application Spawn rundll32 proces action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. action.notable.param.rule_title = Office Application Spawn rundll32 process action.notable.param.security_domain = endpoint @@ -21274,7 +21366,7 @@ action.correlationsearch.label = ESCU - Office Document Creating Schedule Task - action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' action.notable.param.rule_title = Office Document Creating Schedule Task action.notable.param.security_domain = endpoint @@ -21320,7 +21412,7 @@ action.correlationsearch.label = ESCU - Office Document Executing Macro Code - R action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. action.notable.param.rule_title = Office Document Executing Macro Code action.notable.param.security_domain = endpoint @@ -21366,7 +21458,7 @@ action.correlationsearch.label = ESCU - Office Document Spawned Child Process To action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. action.notable.param.rule_title = Office Document Spawned Child Process To Download action.notable.param.security_domain = endpoint @@ -21412,7 +21504,7 @@ action.correlationsearch.label = ESCU - Office Product Spawn CMD Process - Rule action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. action.notable.param.rule_title = Office Product Spawn CMD Process action.notable.param.security_domain = endpoint @@ -21458,7 +21550,7 @@ action.correlationsearch.label = ESCU - Office Product Spawning BITSAdmin - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.notable.param.rule_title = Office Product Spawning BITSAdmin action.notable.param.security_domain = endpoint @@ -21504,7 +21596,7 @@ action.correlationsearch.label = ESCU - Office Product Spawning CertUtil - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line of `certutil.exe` will contain a URL to a remote destination. In addition, Threat Research has released a detections identifying suspicious use of `certutil.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `certutil.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.notable.param.rule_title = Office Product Spawning CertUtil action.notable.param.security_domain = endpoint @@ -21550,7 +21642,7 @@ action.correlationsearch.label = ESCU - Office Product Spawning MSHTA - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. In addition, Threat Research has released a detections identifying suspicious use of `mshta.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `mshta.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.notable.param.rule_title = Office Product Spawning MSHTA action.notable.param.security_domain = endpoint @@ -21596,7 +21688,7 @@ action.correlationsearch.label = ESCU - Office Product Spawning Rundll32 with no action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.notable.param.rule_title = Office Product Spawning Rundll32 with no DLL action.notable.param.security_domain = endpoint @@ -21642,7 +21734,7 @@ action.correlationsearch.label = ESCU - Office Product Spawning Wmic - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "FIN7"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process call create`. In addition, Threat Research has released a detection identifying the use of `wmic process call create` on the command-line of `wmic.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.notable.param.rule_title = Office Product Spawning Wmic action.notable.param.security_domain = endpoint @@ -21688,7 +21780,7 @@ action.correlationsearch.label = ESCU - Office Product Writing cab or inf - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. action.notable.param.rule_title = Office Product Writing cab or inf action.notable.param.security_domain = endpoint @@ -21734,7 +21826,7 @@ action.correlationsearch.label = ESCU - Office Spawning Control - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. review parallel and child processes to identify further suspicious behavior action.notable.param.rule_title = Office Spawning Control action.notable.param.security_domain = endpoint @@ -21780,7 +21872,7 @@ action.correlationsearch.label = ESCU - Outbound Network Connection from Java Us action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving the second stage .class payload. The following analytic identifies the Java process reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection. action.notable.param.rule_title = Outbound Network Connection from Java Using Default Ports action.notable.param.security_domain = endpoint @@ -21826,7 +21918,7 @@ action.correlationsearch.label = ESCU - Overwriting Accessibility Binaries - Rul action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Hermetic Wiper"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546", "T1546.008"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Attacker"], "type": "File"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries. action.notable.param.rule_title = Overwriting Accessibility Binaries action.notable.param.security_domain = endpoint @@ -21912,7 +22004,7 @@ action.correlationsearch.label = ESCU - Permission Modification using Takeown Ap action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. action.notable.param.rule_title = Permission Modification using Takeown App action.notable.param.security_domain = endpoint @@ -21964,7 +22056,7 @@ action.correlationsearch.label = ESCU - PetitPotam Network Share Access Request action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "cve": ["CVE-2021-36942"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1187"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes Windows Event Code 5145, "A network share object was checked to see whether client can be granted desired access". During our research into PetitPotam, CVE-2021-36942, we identified the ocurrence of this event on the target host with specific values. \ To enable 5145 events via Group Policy - Computer Configuration->Polices->Windows Settings->Security Settings->Advanced Audit Policy Configuration. Expand this node, go to Object Access (Audit Polices->Object Access), then select the Setting Audit Detailed File Share Audit \ It is possible this is not enabled by default and may need to be reviewed and enabled. \ @@ -22013,7 +22105,7 @@ action.correlationsearch.label = ESCU - PetitPotam Suspicious Kerberos TGT Reque action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services", "Active Directory Kerberos Attacks"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "cve": ["CVE-2021-36942"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifes Event Code 4768, A `Kerberos authentication ticket (TGT) was requested`, successfull occurs. This behavior has been identified to assist with detecting PetitPotam, CVE-2021-36942. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to Domain Controllers for your environment. action.notable.param.rule_title = PetitPotam Suspicious Kerberos TGT Request action.notable.param.security_domain = endpoint @@ -22139,7 +22231,7 @@ action.correlationsearch.label = ESCU - Possible Lateral Movement PowerShell Spa action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Active Directory Lateral Movement", "Malicious PowerShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution. action.notable.param.rule_title = Possible Lateral Movement PowerShell Spawn action.notable.param.security_domain = endpoint @@ -22305,7 +22397,7 @@ action.correlationsearch.label = ESCU - Powershell Creating Thread Mutex - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.notable.param.rule_title = Powershell Creating Thread Mutex action.notable.param.security_domain = endpoint @@ -22351,7 +22443,7 @@ action.correlationsearch.label = ESCU - Powershell Disable Security Monitoring - action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. action.notable.param.rule_title = Powershell Disable Security Monitoring action.notable.param.security_domain = endpoint @@ -22401,7 +22493,7 @@ action.correlationsearch.label = ESCU - PowerShell Domain Enumeration - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -22449,7 +22541,7 @@ action.correlationsearch.label = ESCU - Powershell Enable SMB1Protocol Feature - action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. action.notable.param.rule_title = Powershell Enable SMB1Protocol Feature action.notable.param.security_domain = endpoint @@ -22495,7 +22587,7 @@ action.correlationsearch.label = ESCU - Powershell Execute COM Object - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. action.notable.param.rule_title = Powershell Execute COM Object action.notable.param.security_domain = endpoint @@ -22547,7 +22639,7 @@ action.correlationsearch.label = ESCU - Powershell Fileless Process Injection vi action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \ In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \ @@ -22602,7 +22694,7 @@ action.correlationsearch.label = ESCU - Powershell Fileless Script Contains Base action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ @@ -22739,7 +22831,7 @@ action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory vi action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -22787,7 +22879,7 @@ action.correlationsearch.label = ESCU - Powershell Processing Stream Of Data - R action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.notable.param.rule_title = Powershell Processing Stream Of Data action.notable.param.security_domain = endpoint @@ -22833,7 +22925,7 @@ action.correlationsearch.label = ESCU - Powershell Remote Thread To Known Window action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload action.notable.param.rule_title = Powershell Remote Thread To Known Windows Process action.notable.param.security_domain = endpoint @@ -22879,7 +22971,7 @@ action.correlationsearch.label = ESCU - Powershell Remove Windows Defender Direc action.correlationsearch.annotations = {"analytic_story": ["WhisperGate"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation. action.notable.param.rule_title = Powershell Remove Windows Defender Directory action.notable.param.security_domain = endpoint @@ -22925,7 +23017,7 @@ action.correlationsearch.label = ESCU - PowerShell Start-BitsTransfer - Rule action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? action.notable.param.rule_title = PowerShell Start-BitsTransfer action.notable.param.security_domain = endpoint @@ -22971,7 +23063,7 @@ action.correlationsearch.label = ESCU - Powershell Using memory As Backing Store action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using memory stream as new object backstore. The malicious PowerShell script will contain stream flate data and will be decompressed in memory to run or drop the actual payload. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.notable.param.rule_title = Powershell Using memory As Backing Store action.notable.param.security_domain = endpoint @@ -23017,7 +23109,7 @@ action.correlationsearch.label = ESCU - Powershell Windows Defender Exclusion Co action.correlationsearch.annotations = {"analytic_story": ["Remcos", "Windows Defense Evasion Tactics", "WhisperGate"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will detect a suspicious process commandline related to windows defender exclusion feature. This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior. action.notable.param.rule_title = Powershell Windows Defender Exclusion Commands action.notable.param.security_domain = endpoint @@ -23063,7 +23155,7 @@ action.correlationsearch.label = ESCU - Prevent Automatic Repair Mode using Bcde action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. action.notable.param.rule_title = Prevent Automatic Repair Mode using Bcdedit action.notable.param.security_domain = endpoint @@ -23113,7 +23205,7 @@ action.correlationsearch.label = ESCU - Print Spooler Adding A Printer Driver - action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "cve": ["CVE-2021-34527", "CVE-2021-1675"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. @@ -23167,7 +23259,7 @@ action.correlationsearch.label = ESCU - Print Spooler Failed to Load a Plug-in - action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "cve": ["CVE-2021-34527", "CVE-2021-1675"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ The analytic is based on file path and failure to load the plug-in. \ @@ -23216,7 +23308,7 @@ action.correlationsearch.label = ESCU - Process Creating LNK file in Suspicious action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. action.notable.param.rule_title = Process Creating LNK file in Suspicious Location action.notable.param.security_domain = network @@ -23262,7 +23354,7 @@ action.correlationsearch.label = ESCU - Process Deleting Its Process File Path - action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "Remcos", "WhisperGate"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This detection is to identify a suspicious process that tries to delete the process file path related to its process. This technique is known to be defense evasion once a certain condition of malware is satisfied or not. Clop ransomware use this technique where it will try to delete its process file path using a .bat command if the keyboard layout is not the layout it tries to infect. action.notable.param.rule_title = Process Deleting Its Process File Path action.notable.param.security_domain = endpoint @@ -23308,7 +23400,7 @@ action.correlationsearch.label = ESCU - Process Execution via WMI - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary. action.notable.param.rule_title = Process Execution via WMI action.notable.param.security_domain = endpoint @@ -23354,7 +23446,7 @@ action.correlationsearch.label = ESCU - Process Kill Base On File Path - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. action.notable.param.rule_title = Process Kill Base On File Path action.notable.param.security_domain = endpoint @@ -23440,7 +23532,7 @@ action.correlationsearch.label = ESCU - Processes launching netsh - Rule action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line. action.notable.param.rule_title = Processes launching netsh action.notable.param.security_domain = endpoint @@ -23526,7 +23618,7 @@ action.correlationsearch.label = ESCU - Recon AVProduct Through Pwh or WMI - Rul action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Ransomware", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.notable.param.rule_title = Recon AVProduct Through Pwh or WMI action.notable.param.security_domain = endpoint @@ -23572,7 +23664,7 @@ action.correlationsearch.label = ESCU - Recon Using WMI Class - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 75, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.notable.param.rule_title = Recon Using WMI Class action.notable.param.security_domain = endpoint @@ -23618,7 +23710,7 @@ action.correlationsearch.label = ESCU - Recursive Delete of Directory In Batch C action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. action.notable.param.rule_title = Recursive Delete of Directory In Batch CMD action.notable.param.security_domain = endpoint @@ -23664,7 +23756,7 @@ action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Re action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. action.notable.param.rule_title = Reg exe Manipulating Windows Services Registry Keys action.notable.param.security_domain = endpoint @@ -23710,7 +23802,7 @@ action.correlationsearch.label = ESCU - Registry Keys for Creating SHIM Database action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. action.notable.param.rule_title = Registry Keys for Creating SHIM Databases action.notable.param.security_domain = endpoint @@ -23756,7 +23848,7 @@ action.correlationsearch.label = ESCU - Registry Keys Used For Persistence - Rul action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A ", "IcedID", "Remcos", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. action.notable.param.rule_title = Registry Keys Used For Persistence action.notable.param.security_domain = endpoint @@ -23802,7 +23894,7 @@ action.correlationsearch.label = ESCU - Registry Keys Used For Privilege Escalat action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse", "Windows Registry Abuse", "Hermetic Wiper"], "cis20": ["CIS 8"], "confidence": 95, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012", "T1546"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. action.notable.param.rule_title = Registry Keys Used For Privilege Escalation action.notable.param.security_domain = endpoint @@ -23928,7 +24020,7 @@ action.correlationsearch.label = ESCU - Remcos client registry install entry - R action.correlationsearch.annotations = {"analytic_story": ["Remcos", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects registry key license at host where Remcos RAT agent is installed. action.notable.param.rule_title = Remcos client registry install entry action.notable.param.security_domain = endpoint @@ -23974,7 +24066,7 @@ action.correlationsearch.label = ESCU - Remcos RAT File Creation in Remcos Folde action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, clipboard grabbing and audio recording. action.notable.param.rule_title = Remcos RAT File Creation in Remcos Folder action.notable.param.security_domain = endpoint @@ -24020,7 +24112,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via DCOM an action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via DCOM and PowerShell action.notable.param.security_domain = endpoint @@ -24066,7 +24158,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via DCOM an action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries alike may abuse DCOM for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via DCOM and PowerShell Script Block action.notable.param.security_domain = endpoint @@ -24112,7 +24204,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via WinRM a action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via WinRM and PowerShell action.notable.param.security_domain = endpoint @@ -24158,7 +24250,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via WinRM a action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via WinRM and PowerShell Script Block action.notable.param.security_domain = endpoint @@ -24204,7 +24296,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via WinRM a action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `winrs.exe` with command-line arguments utilized to start a process on a remote endpoint. Red Teams and adversaries alike may abuse the WinRM protocol and this binary for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via WinRM and Winrs action.notable.param.security_domain = endpoint @@ -24250,7 +24342,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via WMI - R action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Suspicious WMI Use", "Active Directory Lateral Movement"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies wmic.exe being launched with parameters to spawn a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via WMI action.notable.param.security_domain = endpoint @@ -24296,7 +24388,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via WMI and action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and `powershell.exe` for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via WMI and PowerShell action.notable.param.security_domain = endpoint @@ -24342,7 +24434,7 @@ action.correlationsearch.label = ESCU - Remote Process Instantiation via WMI and action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution. action.notable.param.rule_title = Remote Process Instantiation via WMI and PowerShell Script Block action.notable.param.security_domain = endpoint @@ -24388,7 +24480,7 @@ action.correlationsearch.label = ESCU - Remote System Discovery with Adsisearche action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Remote System Discovery with Adsisearcher action.notable.param.security_domain = endpoint @@ -24514,7 +24606,7 @@ action.correlationsearch.label = ESCU - Remote System Discovery with Wmic - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Remote System Discovery with Wmic action.notable.param.security_domain = endpoint @@ -24560,7 +24652,7 @@ action.correlationsearch.label = ESCU - Remote WMI Command Attempt - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed. action.notable.param.rule_title = Remote WMI Command Attempt action.notable.param.security_domain = endpoint @@ -24606,7 +24698,7 @@ action.correlationsearch.label = ESCU - Resize ShadowStorage volume - Rule action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 90, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible action.notable.param.rule_title = Resize ShadowStorage volume action.notable.param.security_domain = endpoint @@ -24652,7 +24744,7 @@ action.correlationsearch.label = ESCU - Revil Common Exec Parameter - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. action.notable.param.rule_title = Revil Common Exec Parameter action.notable.param.security_domain = endpoint @@ -24698,7 +24790,7 @@ action.correlationsearch.label = ESCU - Revil Registry Entry - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. action.notable.param.rule_title = Revil Registry Entry action.notable.param.security_domain = endpoint @@ -24744,7 +24836,7 @@ action.correlationsearch.label = ESCU - Rubeus Command Line Parameters - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003", "T1558", "T1558.003", "T1558.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets, forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks. Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic. action.notable.param.rule_title = Rubeus Command Line Parameters action.notable.param.security_domain = endpoint @@ -24790,7 +24882,7 @@ action.correlationsearch.label = ESCU - Rubeus Kerberos Ticket Exports Through W action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic. action.notable.param.rule_title = Rubeus Kerberos Ticket Exports Through Winlogon Access action.notable.param.security_domain = endpoint @@ -24916,7 +25008,7 @@ action.correlationsearch.label = ESCU - Rundll32 Control RunDLL World Writable D action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. action.notable.param.rule_title = Rundll32 Control RunDLL World Writable Directory action.notable.param.security_domain = endpoint @@ -24962,7 +25054,7 @@ action.correlationsearch.label = ESCU - Rundll32 Create Remote Thread To A Proce action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive information the the compromised host. browser process. action.notable.param.rule_title = Rundll32 Create Remote Thread To A Process action.notable.param.security_domain = endpoint @@ -25008,7 +25100,7 @@ action.correlationsearch.label = ESCU - Rundll32 CreateRemoteThread In Browser - action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted browser process. action.notable.param.rule_title = Rundll32 CreateRemoteThread In Browser action.notable.param.security_domain = endpoint @@ -25054,7 +25146,7 @@ action.correlationsearch.label = ESCU - Rundll32 DNSQuery - Rule action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. action.notable.param.rule_title = Rundll32 DNSQuery action.notable.param.security_domain = endpoint @@ -25100,7 +25192,7 @@ action.correlationsearch.label = ESCU - Rundll32 Process Creating Exe Dll Files action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution. action.notable.param.rule_title = Rundll32 Process Creating Exe Dll Files action.notable.param.security_domain = endpoint @@ -25146,7 +25238,7 @@ action.correlationsearch.label = ESCU - Rundll32 Shimcache Flush - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Living Off The Land"], "confidence": 100, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. action.notable.param.rule_title = Rundll32 Shimcache Flush action.notable.param.security_domain = endpoint @@ -25192,7 +25284,7 @@ action.correlationsearch.label = ESCU - Rundll32 with no Command Line Arguments action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Rundll32 with no Command Line Arguments with Network action.notable.param.security_domain = endpoint @@ -25238,7 +25330,7 @@ action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed. action.notable.param.rule_title = RunDLL Loading DLL By Ordinal action.notable.param.security_domain = endpoint @@ -25284,7 +25376,7 @@ action.correlationsearch.label = ESCU - Ryuk Test Files Detected - Rule action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. action.notable.param.rule_title = Ryuk Test Files Detected action.notable.param.security_domain = endpoint @@ -25330,7 +25422,7 @@ action.correlationsearch.label = ESCU - Ryuk Wake on LAN Command - Rule action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged. action.notable.param.rule_title = Ryuk Wake on LAN Command action.notable.param.security_domain = endpoint @@ -25416,7 +25508,7 @@ action.correlationsearch.label = ESCU - Samsam Test File Write - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 20, "context": ["Source:Endpoint"], "impact": 60, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation. action.notable.param.rule_title = Samsam Test File Write action.notable.param.security_domain = endpoint @@ -25462,7 +25554,7 @@ action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - R action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. action.notable.param.rule_title = Sc exe Manipulating Windows Services action.notable.param.security_domain = endpoint @@ -25548,7 +25640,7 @@ action.correlationsearch.label = ESCU - Schedule Task with HTTP Command Argument action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Living Off The Land"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' action.notable.param.rule_title = Schedule Task with HTTP Command Arguments action.notable.param.security_domain = endpoint @@ -25594,7 +25686,7 @@ action.correlationsearch.label = ESCU - Schedule Task with Rundll32 Command Trig action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot", "IcedID", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' action.notable.param.rule_title = Schedule Task with Rundll32 Command Trigger action.notable.param.security_domain = endpoint @@ -25640,7 +25732,7 @@ action.correlationsearch.label = ESCU - Scheduled Task Creation on Remote Endpoi action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `at.exe` with command-line arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. The `at.exe` binary internally leverages the AT protocol which was deprecated starting with Windows 8 and Windows Server 2012 but may still work on previous versions of Windows. Furthermore, attackers may enable this protocol on demand by changing a sytem registry key. action.notable.param.rule_title = Scheduled Task Creation on Remote Endpoint using At action.notable.param.security_domain = endpoint @@ -25686,7 +25778,7 @@ action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CM action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware". action.notable.param.rule_title = Scheduled Task Deleted Or Created via CMD action.notable.param.security_domain = endpoint @@ -25732,7 +25824,7 @@ action.correlationsearch.label = ESCU - Scheduled Task Initiation on Remote Endp action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `schtasks.exe` with command-line arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. action.notable.param.rule_title = Scheduled Task Initiation on Remote Endpoint action.notable.param.security_domain = endpoint @@ -25764,7 +25856,7 @@ action.escu.full_search_name = ESCU - Schtasks Run Task On Demand - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["XMRig"] +action.escu.analytic_story = ["XMRig", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] @@ -25775,10 +25867,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks Run Task On Demand - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Industroyer2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies an on demand run of a Windows Schedule Task through shell or command-line. This technique has been used by adversaries that force to run their created Schedule Task as their persistence mechanism or for lateral movement as part of their malicious attack to the compromised machine. action.notable.param.rule_title = Schtasks Run Task On Demand action.notable.param.security_domain = endpoint @@ -25824,7 +25916,7 @@ action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "NOBELIUM Group", "Living Off The Land"], "cis20": ["CIS 3"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `schtasks.exe` with command-line arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. action.notable.param.rule_title = Schtasks scheduling job on remote system action.notable.param.security_domain = endpoint @@ -25870,7 +25962,7 @@ action.correlationsearch.label = ESCU - Schtasks used for forcing a reboot - Rul action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled. action.notable.param.rule_title = Schtasks used for forcing a reboot action.notable.param.security_domain = endpoint @@ -25916,7 +26008,7 @@ action.correlationsearch.label = ESCU - Screensaver Event Trigger Execution - Ru action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546", "T1546.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. action.notable.param.rule_title = Screensaver Event Trigger Execution action.notable.param.security_domain = endpoint @@ -25962,7 +26054,7 @@ action.correlationsearch.label = ESCU - Script Execution via WMI - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for scripts launched via WMI. action.notable.param.rule_title = Script Execution via WMI action.notable.param.security_domain = endpoint @@ -26008,7 +26100,7 @@ action.correlationsearch.label = ESCU - Sdclt UAC Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. action.notable.param.rule_title = Sdclt UAC Bypass action.notable.param.security_domain = endpoint @@ -26054,7 +26146,7 @@ action.correlationsearch.label = ESCU - Sdelete Application Execution - Rule action.correlationsearch.annotations = {"analytic_story": ["Masquerading - Rename System Utilities"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. action.notable.param.rule_title = Sdelete Application Execution action.notable.param.security_domain = endpoint @@ -26100,7 +26192,7 @@ action.correlationsearch.label = ESCU - SearchProtocolHost with no Command Line action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = SearchProtocolHost with no Command Line with Network action.notable.param.security_domain = endpoint @@ -26146,7 +26238,7 @@ action.correlationsearch.label = ESCU - SecretDumps Offline NTDS Dumping Tool - action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003", "T1003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. action.notable.param.rule_title = SecretDumps Offline NTDS Dumping Tool action.notable.param.security_domain = endpoint @@ -26200,7 +26292,7 @@ action.correlationsearch.label = ESCU - ServicePrincipalNames Discovery with Pow action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `powershell.exe` usage, using Script Block Logging EventCode 4104, related to querying the domain for Service Principle Names. typically, this is a precursor activity related to kerberoasting or the silver ticket attack. \ What is a ServicePrincipleName? \ A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name.\ @@ -26264,7 +26356,7 @@ action.correlationsearch.label = ESCU - ServicePrincipalNames Discovery with Set action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `setspn.exe` usage related to querying the domain for Service Principle Names. typically, this is a precursor activity related to kerberoasting or the silver ticket attack. \ What is a ServicePrincipleName? \ A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name.\ @@ -26317,7 +26409,7 @@ action.correlationsearch.label = ESCU - Services Escalate Exe - Rule action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 95, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of `svc-exe` with Cobalt Strike. The behavior typically follows after an adversary has already gained initial access and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` with multiple keys and values added to look like a legitimate service. Upon loading, `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. The process lineage is completed with `400619a.exe` spawning rundll32.exe, which is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` process will also contain a network connection. During triage, review parallel procesess and identify any additional file modifications. action.notable.param.rule_title = Services Escalate Exe action.notable.param.security_domain = endpoint @@ -26363,7 +26455,7 @@ action.correlationsearch.label = ESCU - Services LOLBAS Execution Process Spawn action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child process of `services.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. action.notable.param.rule_title = Services LOLBAS Execution Process Spawn action.notable.param.security_domain = endpoint @@ -26409,7 +26501,7 @@ action.correlationsearch.label = ESCU - Set Default PowerShell Execution Policy action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "registry_path", "role": ["Other"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. action.notable.param.rule_title = Set Default PowerShell Execution Policy To Unrestricted or Bypass action.notable.param.security_domain = endpoint @@ -26455,7 +26547,7 @@ action.correlationsearch.label = ESCU - Shim Database File Creation - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. action.notable.param.rule_title = Shim Database File Creation action.notable.param.security_domain = endpoint @@ -26501,7 +26593,7 @@ action.correlationsearch.label = ESCU - Shim Database Installation With Suspicio action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. action.notable.param.rule_title = Shim Database Installation With Suspicious Parameters action.notable.param.security_domain = endpoint @@ -26547,7 +26639,7 @@ action.correlationsearch.label = ESCU - Short Lived Scheduled Task - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic leverages Windows Security EventCode 4698, `A scheduled task was created` and Windows Security EventCode 4699, `A scheduled task was deleted` to identify scheduled tasks created and deleted in less than 30 seconds. This behavior may represent a lateral movement attack abusing the Task Scheduler to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. action.notable.param.rule_title = Short Lived Scheduled Task action.notable.param.security_domain = endpoint @@ -26593,7 +26685,7 @@ action.correlationsearch.label = ESCU - Short Lived Windows Accounts - Rule action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects accounts that were created and deleted in a short time period. action.notable.param.rule_title = Short Lived Windows Accounts action.notable.param.security_domain = access @@ -26639,7 +26731,7 @@ action.correlationsearch.label = ESCU - SilentCleanup UAC Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. action.notable.param.rule_title = SilentCleanup UAC Bypass action.notable.param.security_domain = endpoint @@ -26685,7 +26777,7 @@ action.correlationsearch.label = ESCU - Single Letter Process On Endpoint - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for process names that consist only of a single letter. action.notable.param.rule_title = Single Letter Process On Endpoint action.notable.param.security_domain = endpoint @@ -26731,7 +26823,7 @@ action.correlationsearch.label = ESCU - SLUI RunAs Elevated - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. action.notable.param.rule_title = SLUI RunAs Elevated action.notable.param.security_domain = endpoint @@ -26777,7 +26869,7 @@ action.correlationsearch.label = ESCU - SLUI Spawning a Process - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. action.notable.param.rule_title = SLUI Spawning a Process action.notable.param.security_domain = endpoint @@ -26823,7 +26915,7 @@ action.correlationsearch.label = ESCU - Spoolsv Spawning Rundll32 - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. action.notable.param.rule_title = Spoolsv Spawning Rundll32 action.notable.param.security_domain = endpoint @@ -26869,7 +26961,7 @@ action.correlationsearch.label = ESCU - Spoolsv Suspicious Loaded Modules - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. action.notable.param.rule_title = Spoolsv Suspicious Loaded Modules action.notable.param.security_domain = endpoint @@ -26915,7 +27007,7 @@ action.correlationsearch.label = ESCU - Spoolsv Suspicious Process Access - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. action.notable.param.rule_title = Spoolsv Suspicious Process Access action.notable.param.security_domain = endpoint @@ -26961,7 +27053,7 @@ action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. action.notable.param.rule_title = Spoolsv Writing a DLL action.notable.param.security_domain = endpoint @@ -27007,7 +27099,7 @@ action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Sysmon - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. action.notable.param.rule_title = Spoolsv Writing a DLL - Sysmon action.notable.param.security_domain = endpoint @@ -27053,7 +27145,7 @@ action.correlationsearch.label = ESCU - Sqlite Module In Temp Folder - Rule action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1005"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome or firefox to stole browser information related to bank, credit card or credentials. action.notable.param.rule_title = Sqlite Module In Temp Folder action.notable.param.security_domain = endpoint @@ -27069,52 +27161,6 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") |stats count min(_time) as firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter` -[ESCU - Start Up During Safe Mode Boot - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -action.escu.known_false_positives = updated windows application needed in safe boot may used this registry -action.escu.creation_date = 2022-01-26 -action.escu.modification_date = 2022-01-26 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Start Up During Safe Mode Boot - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_message = Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = [] -action.notable.param.rule_description = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -action.notable.param.rule_title = Start Up During Safe Mode Boot -action.notable.param.security_domain = endpoint -action.notable.param.severity = high -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `start_up_during_safe_mode_boot_filter` - [ESCU - Suspicious Computer Account Name Change - Rule] action.escu = 0 action.escu.enabled = 1 @@ -27145,7 +27191,7 @@ action.correlationsearch.label = ESCU - Suspicious Computer Account Name Change action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a new computer account name and rename it to match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer account names always end with `$`. This analytic leverages Event Id 4781, `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. action.notable.param.rule_title = Suspicious Computer Account Name Change action.notable.param.security_domain = endpoint @@ -27191,7 +27237,7 @@ action.correlationsearch.label = ESCU - Suspicious Copy on System32 - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 90, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.003", "T1036"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. action.notable.param.rule_title = Suspicious Copy on System32 action.notable.param.security_domain = endpoint @@ -27237,7 +27283,7 @@ action.correlationsearch.label = ESCU - Suspicious DLLHost no Command Line Argum action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Suspicious DLLHost no Command Line Arguments action.notable.param.security_domain = endpoint @@ -27283,7 +27329,7 @@ action.correlationsearch.label = ESCU - Suspicious Driver Loaded Path - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. action.notable.param.rule_title = Suspicious Driver Loaded Path action.notable.param.security_domain = endpoint @@ -27329,7 +27375,7 @@ action.correlationsearch.label = ESCU - Suspicious Event Log Service Behavior - action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. action.notable.param.rule_title = Suspicious Event Log Service Behavior action.notable.param.security_domain = endpoint @@ -27375,7 +27421,7 @@ action.correlationsearch.label = ESCU - Suspicious GPUpdate no Command Line Argu action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Suspicious GPUpdate no Command Line Arguments action.notable.param.security_domain = endpoint @@ -27421,7 +27467,7 @@ action.correlationsearch.label = ESCU - Suspicious IcedID Rundll32 Cmdline - Rul action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe commandline to execute dll file. This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted dll payload which is the license.dat. action.notable.param.rule_title = Suspicious IcedID Rundll32 Cmdline action.notable.param.security_domain = endpoint @@ -27467,7 +27513,7 @@ action.correlationsearch.label = ESCU - Suspicious Image Creation In Appdata Fol action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server. This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path. action.notable.param.rule_title = Suspicious Image Creation In Appdata Folder action.notable.param.security_domain = endpoint @@ -27513,7 +27559,7 @@ action.correlationsearch.label = ESCU - Suspicious Kerberos Service Ticket Reque action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. action.notable.param.rule_title = Suspicious Kerberos Service Ticket Request action.notable.param.security_domain = endpoint @@ -27561,7 +27607,7 @@ action.correlationsearch.label = ESCU - Suspicious Linux Discovery Commands - Ru action.correlationsearch.annotations = {"analytic_story": ["Linux Post-Exploitation"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.004"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\ The search logic specifically looks for high number of distinct commands run in a short period of time. action.notable.param.rule_title = Suspicious Linux Discovery Commands @@ -27648,7 +27694,7 @@ action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler u action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies microsoft.workflow.compiler.exe usage. microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. It is not a commonly used process by many applications. action.notable.param.rule_title = Suspicious microsoft workflow compiler usage action.notable.param.security_domain = endpoint @@ -27694,7 +27740,7 @@ action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild. action.notable.param.rule_title = Suspicious msbuild path action.notable.param.security_domain = endpoint @@ -27780,7 +27826,7 @@ action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. action.notable.param.rule_title = Suspicious MSBuild Spawn action.notable.param.security_domain = endpoint @@ -27826,7 +27872,7 @@ action.correlationsearch.label = ESCU - Suspicious mshta child process - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. action.notable.param.rule_title = Suspicious mshta child process action.notable.param.security_domain = endpoint @@ -27872,7 +27918,7 @@ action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe. action.notable.param.rule_title = Suspicious mshta spawn action.notable.param.security_domain = endpoint @@ -27918,7 +27964,7 @@ action.correlationsearch.label = ESCU - Suspicious Process DNS Query Known Abuse action.correlationsearch.annotations = {"analytic_story": ["Remcos", "WhisperGate"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This is a good TTP indicator for possible initial access techniques. A user will experience false positives if the following instant messaging is allowed or common applications like telegram or discord are allowed in the corporate network. action.notable.param.rule_title = Suspicious Process DNS Query Known Abuse Web Services action.notable.param.security_domain = endpoint @@ -27950,7 +27996,7 @@ action.escu.full_search_name = ESCU - Suspicious Process File Path - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper"] +action.escu.analytic_story = ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] @@ -27961,10 +28007,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Process File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious software. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges. action.notable.param.rule_title = Suspicious Process File Path action.notable.param.security_domain = endpoint @@ -28050,7 +28096,7 @@ action.correlationsearch.label = ESCU - Suspicious Reg exe Process - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances. action.notable.param.rule_title = Suspicious Reg exe Process action.notable.param.security_domain = endpoint @@ -28096,7 +28142,7 @@ action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. action.notable.param.rule_title = Suspicious Regsvr32 Register Suspicious Path action.notable.param.security_domain = endpoint @@ -28142,7 +28188,7 @@ action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Suspicious Rundll32 dllregisterserver action.notable.param.security_domain = endpoint @@ -28188,7 +28234,7 @@ action.correlationsearch.label = ESCU - Suspicious Rundll32 PluginInit - Rule action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. action.notable.param.rule_title = Suspicious Rundll32 PluginInit action.notable.param.security_domain = endpoint @@ -28234,7 +28280,7 @@ action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. action.notable.param.rule_title = Suspicious Rundll32 StartW action.notable.param.security_domain = endpoint @@ -28280,7 +28326,7 @@ action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Argu action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Suspicious Rundll32 no Command Line Arguments action.notable.param.security_domain = endpoint @@ -28366,7 +28412,7 @@ action.correlationsearch.label = ESCU - Suspicious SearchProtocolHost no Command action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Suspicious SearchProtocolHost no Command Line Arguments action.notable.param.security_domain = endpoint @@ -28452,7 +28498,7 @@ action.correlationsearch.label = ESCU - Suspicious WAV file in Appdata Folder - action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file. action.notable.param.rule_title = Suspicious WAV file in Appdata Folder action.notable.param.security_domain = endpoint @@ -28498,7 +28544,7 @@ action.correlationsearch.label = ESCU - Suspicious wevtutil Usage - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001", "T1070"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. action.notable.param.rule_title = Suspicious wevtutil Usage action.notable.param.security_domain = endpoint @@ -28544,7 +28590,7 @@ action.correlationsearch.label = ESCU - Suspicious writes to windows Recycle Bin action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects writes to the recycle bin by a process other than explorer.exe. action.notable.param.rule_title = Suspicious writes to windows Recycle Bin action.notable.param.security_domain = endpoint @@ -28590,7 +28636,7 @@ action.correlationsearch.label = ESCU - Svchost LOLBAS Execution Process Spawn - action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned as a child process of `svchost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. action.notable.param.rule_title = Svchost LOLBAS Execution Process Spawn action.notable.param.security_domain = endpoint @@ -28676,7 +28722,7 @@ action.correlationsearch.label = ESCU - System Information Discovery Detection - action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Recon", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. action.notable.param.rule_title = System Information Discovery Detection action.notable.param.security_domain = endpoint @@ -28726,7 +28772,7 @@ action.correlationsearch.label = ESCU - System Processes Run From Unexpected Loc action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for system processes that typically execute from `C:\Windows\System32\` or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying to hide as a legitimate process.\ This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\ During triage, review the parallel processes - what process moved the native Windows binary? identify any artifacts on disk and review. If a remote destination is contacted, what is the reputation? @@ -28854,7 +28900,7 @@ action.correlationsearch.label = ESCU - Time Provider Persistence Registry - Rul action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. action.notable.param.rule_title = Time Provider Persistence Registry action.notable.param.security_domain = endpoint @@ -28900,7 +28946,7 @@ action.correlationsearch.label = ESCU - Trickbot Named Pipe - Rule action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "Image", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. action.notable.param.rule_title = Trickbot Named Pipe action.notable.param.security_domain = endpoint @@ -28946,7 +28992,7 @@ action.correlationsearch.label = ESCU - UAC Bypass MMC Load Unsigned Dll - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path action.notable.param.rule_title = UAC Bypass MMC Load Unsigned Dll action.notable.param.security_domain = endpoint @@ -28992,7 +29038,7 @@ action.correlationsearch.label = ESCU - UAC Bypass With Colorui COM Object - Rul action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. action.notable.param.rule_title = UAC Bypass With Colorui COM Object action.notable.param.security_domain = endpoint @@ -29038,7 +29084,7 @@ action.correlationsearch.label = ESCU - Unified Messaging Service Spawning a Pro action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-26857"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the active exploitation. During triage, identify any additional suspicious parallel processes. Identify any recent out of place file modifications. Review Exchange logs following Microsofts guide. To contain, perform egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor. action.notable.param.rule_title = Unified Messaging Service Spawning a Process action.notable.param.security_domain = endpoint @@ -29084,7 +29130,7 @@ action.correlationsearch.label = ESCU - Uninstall App Using MsiExec - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007", "T1218"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product is not a common practice in enterprise network. action.notable.param.rule_title = Uninstall App Using MsiExec action.notable.param.security_domain = endpoint @@ -29130,7 +29176,7 @@ action.correlationsearch.label = ESCU - Unknown Process Using The Kerberos Proto action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1550"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest_ip", "role": ["Victim"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a process performing an outbound connection on port 88 used by default by the network authentication protocol Kerberos. Typically, on a regular Windows endpoint, only the lsass.exe process is the one tasked with connecting to the Kerberos Distribution Center to obtain Kerberos tickets. Identifying an unknown process using this protocol may be evidence of an adversary abusing the Kerberos protocol. action.notable.param.rule_title = Unknown Process Using The Kerberos Protocol action.notable.param.security_domain = endpoint @@ -29176,7 +29222,7 @@ action.correlationsearch.label = ESCU - Unload Sysmon Filter Driver - Rule action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. action.notable.param.rule_title = Unload Sysmon Filter Driver action.notable.param.security_domain = endpoint @@ -29226,7 +29272,7 @@ action.correlationsearch.label = ESCU - Unloading AMSI via Reflection - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -29396,7 +29442,7 @@ action.correlationsearch.label = ESCU - USN Journal Deletion - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal. action.notable.param.rule_title = USN Journal Deletion action.notable.param.security_domain = endpoint @@ -29442,7 +29488,7 @@ action.correlationsearch.label = ESCU - Vbscript Execution Using Wscript App - R action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. action.notable.param.rule_title = Vbscript Execution Using Wscript App action.notable.param.security_domain = endpoint @@ -29528,7 +29574,7 @@ action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers. During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. action.notable.param.rule_title = W3WP Spawning Shell action.notable.param.security_domain = endpoint @@ -29574,7 +29620,7 @@ action.correlationsearch.label = ESCU - WBAdmin Delete System Backups - Rule action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. action.notable.param.rule_title = WBAdmin Delete System Backups action.notable.param.security_domain = endpoint @@ -29620,7 +29666,7 @@ action.correlationsearch.label = ESCU - Wbemprox COM Object Execution - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, action.notable.param.rule_title = Wbemprox COM Object Execution action.notable.param.security_domain = endpoint @@ -29666,7 +29712,7 @@ action.correlationsearch.label = ESCU - Wermgr Process Connecting To IP Check We action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590", "T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. action.notable.param.rule_title = Wermgr Process Connecting To IP Check Web Services action.notable.param.security_domain = endpoint @@ -29712,7 +29758,7 @@ action.correlationsearch.label = ESCU - Wermgr Process Create Executable File - action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload action.notable.param.rule_title = Wermgr Process Create Executable File action.notable.param.security_domain = endpoint @@ -29758,7 +29804,7 @@ action.correlationsearch.label = ESCU - Wermgr Process Spawned CMD Or Powershell action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. action.notable.param.rule_title = Wermgr Process Spawned CMD Or Powershell Process action.notable.param.security_domain = endpoint @@ -29804,7 +29850,7 @@ action.correlationsearch.label = ESCU - Wget Download and Bash Execution - Rule action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of wget on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. action.notable.param.rule_title = Wget Download and Bash Execution action.notable.param.security_domain = endpoint @@ -29850,7 +29896,7 @@ action.correlationsearch.label = ESCU - Windows AdFind Exe - Rule action.correlationsearch.annotations = {"analytic_story": ["NOBELIUM Group", "Domain Trust Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller. action.notable.param.rule_title = Windows AdFind Exe action.notable.param.security_domain = endpoint @@ -29866,6 +29912,144 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter` +[ESCU - Windows Computer Account Created by Computer Account - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifes a Computer Account creating a new Computer Account with specific a Service Principle Name - "RestrictedKrbHost". The RestrictedKrbHost service class allows client applications to use Kerberos authentication when they do not have the identity of the service but have the server name. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifes a Computer Account creating a new Computer Account with specific a Service Principle Name - "RestrictedKrbHost". The RestrictedKrbHost service class allows client applications to use Kerberos authentication when they do not have the identity of the service but have the server name. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. +action.escu.known_false_positives = It is possible third party applications may have a computer account that adds computer accounts, filtering may be required. +action.escu.creation_date = 2022-04-27 +action.escu.modification_date = 2022-04-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Computer Account Created by Computer Account - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"] +action.risk = 1 +action.risk.param._risk_message = A Computer Account created a Computer Account on $dest$, possibly indicative of Kerberos relay attack. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Computer Account Created by Computer Account - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifes a Computer Account creating a new Computer Account with specific a Service Principle Name - "RestrictedKrbHost". The RestrictedKrbHost service class allows client applications to use Kerberos authentication when they do not have the identity of the service but have the server name. +action.notable.param.rule_title = Windows Computer Account Created by Computer Account +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4741 user_type=computer Subject_Account_Domain!="NT AUTHORITY" Message=*RestrictedKrbHost* | stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action ,src_user, user, Account_Name, Subject_Account_Name,Subject_Account_Domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_created_by_computer_account_filter` + +[ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a ComputerAccount requesting a Kerberos Ticket. typically, a user account requests a Kerberos ticket. This behavior was identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar behavior. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a ComputerAccount requesting a Kerberos Ticket. typically, a user account requests a Kerberos ticket. This behavior was identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar behavior. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required. +action.escu.known_false_positives = It is possible false positives will be present based on third party applications. Filtering may be needed. +action.escu.creation_date = 2022-04-27 +action.escu.modification_date = 2022-04-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"] +action.risk = 1 +action.risk.param._risk_message = A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies a ComputerAccount requesting a Kerberos Ticket. typically, a user account requests a Kerberos ticket. This behavior was identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar behavior. +action.notable.param.rule_title = Windows Computer Account Requesting Kerberos Ticket +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4768 Account_Name="*$" src_ip!="::1" | stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action, Supplied_Realm_Name, user, Account_Name, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_requesting_kerberos_ticket_filter` + +[ESCU - Windows Computer Account With SPN - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added using the KrbRelayUp behavior. This particular behavior has been found in other Kerberos based attacks. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added using the KrbRelayUp behavior. This particular behavior has been found in other Kerberos based attacks. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. +action.escu.known_false_positives = It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed. +action.escu.creation_date = 2022-04-28 +action.escu.modification_date = 2022-04-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Computer Account With SPN - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"] +action.risk = 1 +action.risk.param._risk_message = A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Computer Account With SPN - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added using the KrbRelayUp behavior. This particular behavior has been found in other Kerberos based attacks. +action.notable.param.rule_title = Windows Computer Account With SPN +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4741 MSADChangedAttributes IN ("*HOST/*","*RestrictedKrbHost/*") AND New_UAC_Value=0x80 | eval Effecting_Account=mvindex(Security_ID,1) | eval New_Computer_Account_Name=mvindex(Security_ID,0) | stats count min(_time) as firstTime max(_time) as lastTime values(EventCode),values(Account_Domain),values(Security_ID), values(Effecting_Account), values(New_Computer_Account_Name),values(SAM_Account_Name),values(DNS_Host_Name),values(MSADChangedAttributes) by dest Logon_ID subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_with_spn_filter` + [ESCU - Windows Curl Download to Suspicious Path - Rule] action.escu = 0 action.escu.enabled = 1 @@ -29900,7 +30084,7 @@ action.correlationsearch.label = ESCU - Windows Curl Download to Suspicious Path action.correlationsearch.annotations = {"analytic_story": ["IceID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \ -O or --output is used when a file is to be downloaded and placed in a specified location. \ During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze. @@ -29956,7 +30140,7 @@ action.correlationsearch.label = ESCU - Windows Curl Upload to Remote Destinatio action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \ `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \ `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \ @@ -30006,7 +30190,7 @@ action.correlationsearch.label = ESCU - Windows Defender Exclusion Registry Entr action.correlationsearch.annotations = {"analytic_story": ["Remcos", "Windows Defense Evasion Tactics"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature. This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for a defense evasion and to look further for events after this behavior. action.notable.param.rule_title = Windows Defender Exclusion Registry Entry action.notable.param.security_domain = endpoint @@ -30212,7 +30396,7 @@ action.correlationsearch.label = ESCU - Windows Disable Memory Crash Dump - Rule action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Ransomware", "Hermetic Wiper", "Windows Registry Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to 0. This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check). action.notable.param.rule_title = Windows Disable Memory Crash Dump action.notable.param.security_domain = endpoint @@ -30378,7 +30562,7 @@ action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Ru action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.notable.param.rule_title = Windows DisableAntiSpyware Registry action.notable.param.security_domain = endpoint @@ -30510,7 +30694,7 @@ action.correlationsearch.label = ESCU - Windows Diskshadow Proxy Execution - Rul action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow. action.notable.param.rule_title = Windows Diskshadow Proxy Execution action.notable.param.security_domain = endpoint @@ -30556,7 +30740,7 @@ action.correlationsearch.label = ESCU - Windows DISM Remove Defender - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. action.notable.param.rule_title = Windows DISM Remove Defender action.notable.param.security_domain = access @@ -30602,7 +30786,7 @@ action.correlationsearch.label = ESCU - Windows DotNet Binary in Non Standard Pa action.correlationsearch.annotations = {"analytic_story": ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1036.003", "T1218", "T1218.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process name and original file name (internal name). The analytic utilizes a lookup with the is_net_windows_file macro to identify the binary process name and original file name. if one or the other matches an alert will be generated. Adversaries abuse these binaries as they are native to windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the lookup. action.notable.param.rule_title = Windows DotNet Binary in Non Standard Path action.notable.param.security_domain = endpoint @@ -30618,6 +30802,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `is_net_windows_file` | `windows_dotnet_binary_in_non_standard_path_filter` +[ESCU - Windows Drivers Loaded by Signature - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic assists with viewing all drivers being loaded by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to assist with identifying suspicious drivers. Use this analytic to look at prevalence of driver (count), path of driver, signature status and hash. Review these fields with scrutiny until the ability to prove the driver is legitimate and has a purpose in the environment. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1014"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic assists with viewing all drivers being loaded by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to assist with identifying suspicious drivers. Use this analytic to look at prevalence of driver (count), path of driver, signature status and hash. Review these fields with scrutiny until the ability to prove the driver is legitimate and has a purpose in the environment. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. +action.escu.known_false_positives = This analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat. +action.escu.creation_date = 2022-03-30 +action.escu.modification_date = 2022-03-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Drivers Loaded by Signature - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Drivers"] +action.risk = 1 +action.risk.param._risk_message = A driver has loaded on $Computer$. +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Drivers Loaded by Signature - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Drivers"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1014"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=6 | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) count by Computer Signed Signature service_signature_verified service_signature_exists Hashes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_drivers_loaded_by_signature_filter` + [ESCU - Windows Event For Service Disabled - Rule] action.escu = 0 action.escu.enabled = 1 @@ -30688,7 +30912,7 @@ action.correlationsearch.label = ESCU - Windows Event Log Cleared - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. action.notable.param.rule_title = Windows Event Log Cleared action.notable.param.security_domain = endpoint @@ -30734,7 +30958,7 @@ action.correlationsearch.label = ESCU - Windows Excessive Disabled Services Even action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact to complete the objective on the compromised system. One good example for this scenario is Olympic destroyer where it disable all active services in the compromised host as part of its destructive impact and defense evasion. action.notable.param.rule_title = Windows Excessive Disabled Services Event action.notable.param.security_domain = endpoint @@ -30780,7 +31004,7 @@ action.correlationsearch.label = ESCU - Windows File Without Extension In Critic action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Hermetic Wiper"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive malware that wipes the boot sector of the system. action.notable.param.rule_title = Windows File Without Extension In Critical Folder action.notable.param.security_domain = endpoint @@ -30826,7 +31050,7 @@ action.correlationsearch.label = ESCU - Windows Get-AdComputer Unconstrained Del action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the Get-ADComputer commandlet used with specific parameters to discover Windows endpoints with Kerberos Unconstrained Delegation. Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Windows Get-AdComputer Unconstrained Delegation Discovery action.notable.param.security_domain = endpoint @@ -30992,7 +31216,7 @@ action.correlationsearch.label = ESCU - Windows Indirect Command Execution Via f action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 8", "CIS 10"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.AE"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic detects programs that have been started by forfiles.exe. According to Microsoft, the 'The forfiles command lets you run a command on or pass arguments to multiple files'. While this tool can be used to start legitimate programs, usually within the context of a batch script, it has been observed being used to evade protections on command line execution. action.notable.param.rule_title = Windows Indirect Command Execution Via forfiles action.notable.param.security_domain = endpoint @@ -31038,7 +31262,7 @@ action.correlationsearch.label = ESCU - Windows Indirect Command Execution Via p action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 8", "CIS 10"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.AE"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic detects programs that have been started by pcalua.exe. pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this tool can be used to start legitimate programs, it has been observed being used to evade protections on command line execution. action.notable.param.rule_title = Windows Indirect Command Execution Via pcalua action.notable.param.security_domain = endpoint @@ -31090,7 +31314,7 @@ action.correlationsearch.label = ESCU - Windows InstallUtil Credential Theft - R action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like MimiKatz. \ When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ @@ -31139,7 +31363,7 @@ action.correlationsearch.label = ESCU - Windows InstallUtil in Non Standard Path action.correlationsearch.annotations = {"analytic_story": ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate", "Living Off The Land"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1036.003", "T1218", "T1218.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name. action.notable.param.rule_title = Windows InstallUtil in Non Standard Path action.notable.param.security_domain = endpoint @@ -31191,7 +31415,7 @@ action.correlationsearch.label = ESCU - Windows InstallUtil Remote Network Conne action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ @@ -31248,7 +31472,7 @@ action.correlationsearch.label = ESCU - Windows InstallUtil Uninstall Option - R action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows InstallUtil.exe binary. This will execute code while bypassing application control using the `/u` (uninstall) switch. \ InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ @@ -31306,7 +31530,7 @@ action.correlationsearch.label = ESCU - Windows InstallUtil Uninstall Option wit action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ @@ -31362,7 +31586,7 @@ action.correlationsearch.label = ESCU - Windows InstallUtil URL in Command Line action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows InstallUtil.exe binary passing a HTTP request on the command-line. This technique may be used to download and execute code while bypassing application control. \ When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ @@ -31427,6 +31651,138 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` +[ESCU - Windows ISO LNK File Creation - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566", "T1204.001", "T1204"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. +action.escu.creation_date = 2022-03-29 +action.escu.modification_date = 2022-03-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows ISO LNK File Creation - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows ISO LNK File Creation - Rule +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566", "T1204.001", "T1204"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter` + +[ESCU - Windows Kerberos Local Successful Logon - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. The target user security identified will be set to the built-in local Administrator account, along with the remote address as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. Upon triage, review for recently ran binaries on disk. In addition, look for new computer accounts added to Active Directory and other anomolous AD events. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. The target user security identified will be set to the built-in local Administrator account, along with the remote address as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. Upon triage, review for recently ran binaries on disk. In addition, look for new computer accounts added to Active Directory and other anomolous AD events. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. +action.escu.known_false_positives = False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed. +action.escu.creation_date = 2022-04-27 +action.escu.modification_date = 2022-04-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Kerberos Local Successful Logon - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"] +action.risk = 1 +action.risk.param._risk_message = A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Kerberos Local Successful Logon - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. The target user security identified will be set to the built-in local Administrator account, along with the remote address as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. Upon triage, review for recently ran binaries on disk. In addition, look for new computer accounts added to Active Directory and other anomolous AD events. +action.notable.param.rule_title = Windows Kerberos Local Successful Logon +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4624 Logon_Type=3 Authentication_Package=Kerberos action=success src_ip=127.0.0.1 | stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action, Security_ID, user, Account_Name, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_kerberos_local_successful_logon_filter` + +[ESCU - Windows KrbRelayUp Service Creation - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the default service name created by KrbRelayUp. Defenders should be aware that attackers could change the hardcoded service name of the KrbRelayUp tool and bypass this detection. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies the default service name created by KrbRelayUp. Defenders should be aware that attackers could change the hardcoded service name of the KrbRelayUp tool and bypass this detection. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also required. +action.escu.known_false_positives = False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed. +action.escu.creation_date = 2022-05-02 +action.escu.modification_date = 2022-05-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows KrbRelayUp Service Creation - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Local Privilege Escalation With KrbRelayUp"] +action.risk = 1 +action.risk.param._risk_message = A service was created on $dest$, related to KrbRelayUp. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows KrbRelayUp Service Creation - Rule +action.correlationsearch.annotations = {"analytic_story": ["Local Privilege Escalation With KrbRelayUp"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies the default service name created by KrbRelayUp. Defenders should be aware that attackers could change the hardcoded service name of the KrbRelayUp tool and bypass this detection. +action.notable.param.rule_title = Windows KrbRelayUp Service Creation +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_krbrelayup_service_creation_filter` + [ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule] action.escu = 0 action.escu.enabled = 1 @@ -31457,7 +31813,7 @@ action.correlationsearch.label = ESCU - Windows Modify Show Compress Color And I action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Windows Defense Evasion Tactics", "Hermetic Wiper", "Windows Registry Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to look for suspicious registry modification related to file compression color and information tips. This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions related to file compression attribution in terms of color in NTFS file system. action.notable.param.rule_title = Windows Modify Show Compress Color And Info Tip Registry action.notable.param.security_domain = endpoint @@ -31503,7 +31859,7 @@ action.correlationsearch.label = ESCU - Windows NirSoft AdvancedRun - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Ransomware", "WhisperGate"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. The analytic is written in a way to identify a renamed binary and also the common command-line arguments. action.notable.param.rule_title = Windows NirSoft AdvancedRun action.notable.param.security_domain = endpoint @@ -31589,7 +31945,7 @@ action.correlationsearch.label = ESCU - Windows Non-System Account Targeting Lsa action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "SourceImage", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies non SYSTEM accounts requesting access to lsass.exe. This behavior may be related to credential dumping or applications requiring access to credentials. Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes. action.notable.param.rule_title = Windows Non-System Account Targeting Lsass action.notable.param.security_domain = endpoint @@ -31643,7 +31999,7 @@ action.correlationsearch.label = ESCU - Windows Possible Credential Dumping - Ru action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "SourceImage", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic is an enhanced version of two previous analytics that identifies common GrantedAccess permission requests and CallTrace DLLs in order to detect credential dumping. \ GrantedAccess is the requested permissions by the SourceImage into the TargetImage. \ CallTrace Stack trace of where open process is called. Included is the DLL and the relative virtual address of the functions in the call stack right before the open process call. \ @@ -31693,7 +32049,7 @@ action.correlationsearch.label = ESCU - Windows PowerView Constrained Delegation action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify commandlets used by the PowerView hacking tool leveraged to discover Windows endpoints with Kerberos Constrained Delegation. Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Windows PowerView Constrained Delegation Discovery action.notable.param.security_domain = endpoint @@ -31739,7 +32095,7 @@ action.correlationsearch.label = ESCU - Windows PowerView Unconstrained Delegati action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify commandlets used by the PowerView hacking tool leveraged to discover Windows endpoints with Kerberos Unconstrained Delegation. Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Windows PowerView Unconstrained Delegation Discovery action.notable.param.security_domain = endpoint @@ -31825,7 +32181,7 @@ action.correlationsearch.label = ESCU - Windows Raccine Scheduled Task Deletion action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher Florian Roth, designed to intercept and prevent precursors and active ransomware behavior. action.notable.param.rule_title = Windows Raccine Scheduled Task Deletion action.notable.param.security_domain = endpoint @@ -31871,7 +32227,7 @@ action.correlationsearch.label = ESCU - Windows Rasautou DLL Execution - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads. action.notable.param.rule_title = Windows Rasautou DLL Execution action.notable.param.security_domain = endpoint @@ -31957,7 +32313,7 @@ action.correlationsearch.label = ESCU - Windows Raw Access To Master Boot Record action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Caddy Wiper", "WhisperGate", "Hermetic Wiper"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1561.002", "T1561"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector. action.notable.param.rule_title = Windows Raw Access To Master Boot Record Drive action.notable.param.security_domain = endpoint @@ -31973,6 +32329,144 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter` +[ESCU - Windows Registry Certificate Added - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint. +action.escu.creation_date = 2022-03-31 +action.escu.modification_date = 2022-03-31 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Registry Certificate Added - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Drivers", "Windows Registry Abuse"] +action.risk = 1 +action.risk.param._risk_message = A root certificate was added on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Registry Certificate Added - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Drivers", "Windows Registry Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning. +action.notable.param.rule_title = Windows Registry Certificate Added +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_registry_certificate_added_filter` + +[ESCU - Windows Registry Delete Task SD - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel. +action.escu.creation_date = 2022-04-13 +action.escu.modification_date = 2022-04-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Registry Delete Task SD - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Registry Abuse", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_message = A scheduled task security descriptor was deleted from the registry on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Registry Delete Task SD - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Registry Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM. +action.notable.param.rule_title = Windows Registry Delete Task SD +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified) by _time Registry.dest Registry.process_guid Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data Registry.status Registry.action | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter` + +[ESCU - Windows Registry Modification for Safe Mode Persistence - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal and Network. adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal and Network. adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = updated windows application needed in safe boot may used this registry +action.escu.creation_date = 2022-03-31 +action.escu.modification_date = 2022-03-31 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Registry Modification for Safe Mode Persistence - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse", "Windows Drivers"] +action.risk = 1 +action.risk.param._risk_message = Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Registry Modification for Safe Mode Persistence - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Registry Abuse", "Windows Drivers"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal and Network. adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. +action.notable.param.rule_title = Windows Registry Modification for Safe Mode Persistence +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter` + [ESCU - Windows Remote Assistance Spawning Process - Rule] action.escu = 0 action.escu.enabled = 1 @@ -32003,7 +32497,7 @@ action.correlationsearch.label = ESCU - Windows Remote Assistance Spawning Proce action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source. action.notable.param.rule_title = Windows Remote Assistance Spawning Process action.notable.param.security_domain = endpoint @@ -32049,7 +32543,7 @@ action.correlationsearch.label = ESCU - Windows Schtasks Create Run As System - action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state. action.notable.param.rule_title = Windows Schtasks Create Run As System action.notable.param.security_domain = endpoint @@ -32095,7 +32589,7 @@ action.correlationsearch.label = ESCU - Windows Security Account Manager Stopped action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. action.notable.param.rule_title = Windows Security Account Manager Stopped action.notable.param.security_domain = endpoint @@ -32141,7 +32635,7 @@ action.correlationsearch.label = ESCU - Windows Service Created With Suspicious action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "Active Directory Lateral Movement"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. action.notable.param.rule_title = Windows Service Created With Suspicious Service Path action.notable.param.security_domain = endpoint @@ -32187,7 +32681,7 @@ action.correlationsearch.label = ESCU - Windows Service Created Within Public Pa action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path is located in public paths. This behavior could represent the installation of a malicious service. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution action.notable.param.rule_title = Windows Service Created Within Public Path action.notable.param.security_domain = endpoint @@ -32233,7 +32727,7 @@ action.correlationsearch.label = ESCU - Windows Service Creation on Remote Endpo action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `sc.exe` with command-line arguments utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. action.notable.param.rule_title = Windows Service Creation on Remote Endpoint action.notable.param.security_domain = endpoint @@ -32279,7 +32773,7 @@ action.correlationsearch.label = ESCU - Windows Service Creation Using Registry action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Lateral Movement", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to look for suspicious modification or creation of registry to have service entry. This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. This technique can be executed using reg.exe application or using windows API like for example the CrashOveride malware. This detection is a good indicator that a process is trying to create a service entry using registry ImagePath. action.notable.param.rule_title = Windows Service Creation Using Registry Entry action.notable.param.security_domain = endpoint @@ -32325,7 +32819,7 @@ action.correlationsearch.label = ESCU - Windows Service Initiation on Remote End action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the execution of `sc.exe` with command-line arguments utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. action.notable.param.rule_title = Windows Service Initiation on Remote Endpoint action.notable.param.security_domain = endpoint @@ -32505,7 +32999,7 @@ action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created to Spawn action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows shell (PowerShell, Cmd, Wscript, Cscript).\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ @@ -32549,7 +33043,7 @@ action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created Within Pub action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement"] +action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "unknown"}] @@ -32560,10 +33054,10 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable file path.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ @@ -32581,7 +33075,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter` +search = `wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter` [ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule] action.escu = 0 @@ -32599,7 +33093,7 @@ action.escu.full_search_name = ESCU - WinEvent Windows Task Scheduler Event Acti action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques"] +action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques", "Industroyer2"] action.risk = 1 action.risk.param._risk_message = A Scheduled Task was scheduled and ran on $dest$. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] @@ -32610,7 +33104,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Persistence Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Persistence Techniques", "Industroyer2"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -32653,7 +33147,7 @@ action.correlationsearch.label = ESCU - Winhlp32 Spawning a Process - Rule action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. action.notable.param.rule_title = Winhlp32 Spawning a Process action.notable.param.security_domain = endpoint @@ -32699,7 +33193,7 @@ action.correlationsearch.label = ESCU - Winword Spawning Cmd - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line will indicate what is being executed. During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. action.notable.param.rule_title = Winword Spawning Cmd action.notable.param.security_domain = endpoint @@ -32745,7 +33239,7 @@ action.correlationsearch.label = ESCU - Winword Spawning PowerShell - Rule action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. action.notable.param.rule_title = Winword Spawning PowerShell action.notable.param.security_domain = endpoint @@ -32791,7 +33285,7 @@ action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - R action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. action.notable.param.rule_title = Winword Spawning Windows Script Host action.notable.param.security_domain = endpoint @@ -32847,7 +33341,7 @@ action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Sysmo action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003", "T1546"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ 1. Filter - WQL Query for the events we want. EventID = 19 \ @@ -32898,7 +33392,7 @@ action.correlationsearch.label = ESCU - WMI Recon Running Process Or Services - action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.notable.param.rule_title = WMI Recon Running Process Or Services action.notable.param.security_domain = endpoint @@ -33028,7 +33522,7 @@ action.correlationsearch.label = ESCU - WMIC XSL Execution via URL - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1220"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this technique to invoke JScript or VBScript within an XSL file. This technique can also execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying a suspicious execution, review for confirmed network connnection and script download. action.notable.param.rule_title = WMIC XSL Execution via URL action.notable.param.security_domain = endpoint @@ -33074,7 +33568,7 @@ action.correlationsearch.label = ESCU - Wmiprsve LOLBAS Execution Process Spawn action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. action.notable.param.rule_title = Wmiprsve LOLBAS Execution Process Spawn action.notable.param.security_domain = endpoint @@ -33120,7 +33614,7 @@ action.correlationsearch.label = ESCU - Wscript Or Cscript Suspicious Child Proc action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos", "Unusual Processes", "WhisperGate"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1543", "T1134.004", "T1134"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies a suspicious spawned process by WScript or CScript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other scripts like PowerShell or spawn a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. action.notable.param.rule_title = Wscript Or Cscript Suspicious Child Process action.notable.param.security_domain = endpoint @@ -33166,7 +33660,7 @@ action.correlationsearch.label = ESCU - Wsmprovhost LOLBAS Execution Process Spa action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) protocol, the executed command is spawned as a child processs of `Wsmprovhost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. action.notable.param.rule_title = Wsmprovhost LOLBAS Execution Process Spawn action.notable.param.security_domain = endpoint @@ -33212,7 +33706,7 @@ action.correlationsearch.label = ESCU - WSReset UAC Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Living Off The Land", "Windows Registry Abuse"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. action.notable.param.rule_title = WSReset UAC Bypass action.notable.param.security_domain = endpoint @@ -33258,7 +33752,7 @@ action.correlationsearch.label = ESCU - XMRIG Driver Loaded - Rule action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. action.notable.param.rule_title = XMRIG Driver Loaded action.notable.param.security_domain = endpoint @@ -33304,7 +33798,7 @@ action.correlationsearch.label = ESCU - XSL Script Execution With WMIC - Rule action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Suspicious WMI Use"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1220"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique. action.notable.param.rule_title = XSL Script Execution With WMIC action.notable.param.security_domain = endpoint @@ -33350,7 +33844,7 @@ action.correlationsearch.label = ESCU - Detect New Login Attempts to Routers - R action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days. action.notable.param.rule_title = Detect New Login Attempts to Routers action.notable.param.security_domain = network @@ -33438,7 +33932,7 @@ action.correlationsearch.label = ESCU - Email files written outside of the Outlo action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. action.notable.param.rule_title = Email files written outside of the Outlook directory action.notable.param.security_domain = endpoint @@ -33524,7 +34018,7 @@ action.correlationsearch.label = ESCU - Monitor Email For Brand Abuse - Rule action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"], "cis20": ["CIS 7"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse. action.notable.param.rule_title = Monitor Email For Brand Abuse action.notable.param.security_domain = network @@ -33570,7 +34064,7 @@ action.correlationsearch.label = ESCU - Multiple Okta Users With Invalid Credent action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. action.notable.param.rule_title = Multiple Okta Users With Invalid Credentials From The Same IP action.notable.param.security_domain = access @@ -33858,7 +34352,7 @@ action.correlationsearch.label = ESCU - Web Servers Executing Suspicious Process action.correlationsearch.annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for suspicious processes on all systems labeled as web servers. action.notable.param.rule_title = Web Servers Executing Suspicious Processes action.notable.param.security_domain = endpoint @@ -34304,7 +34798,7 @@ action.correlationsearch.label = ESCU - Detect New Open GCP Storage Buckets - Ru action.correlationsearch.annotations = {"analytic_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. action.notable.param.rule_title = Detect New Open GCP Storage Buckets action.notable.param.security_domain = network @@ -34510,7 +35004,7 @@ action.correlationsearch.label = ESCU - GCP Detect gcploit framework - Rule action.correlationsearch.annotations = {"analytic_story": ["GCP Cross Account Activity"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts. action.notable.param.rule_title = GCP Detect gcploit framework action.notable.param.security_domain = threat @@ -34796,7 +35290,7 @@ action.correlationsearch.label = ESCU - Child Processes of Spoolsv exe - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Hermetic Wiper"], "cis20": ["CIS 5", "CIS 8"], "confidence": 50, "cve": ["CVE-2018-8440"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for child processes of spoolsv.exe. This activity is associated with a POC privilege-escalation exploit associated with CVE-2018-8440. Spoolsv.exe is the process associated with the Print Spooler service in Windows and typically runs as SYSTEM. action.notable.param.rule_title = Child Processes of Spoolsv exe action.notable.param.security_domain = endpoint @@ -34842,7 +35336,7 @@ action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 - Rul action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "confidence": 50, "cve": ["CVE-2021-3156"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit action.notable.param.rule_title = Detect Baron Samedit CVE-2021-3156 action.notable.param.security_domain = endpoint @@ -34888,7 +35382,7 @@ action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 Segfa action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "confidence": 50, "cve": ["CVE-2021-3156"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit action.notable.param.rule_title = Detect Baron Samedit CVE-2021-3156 Segfault action.notable.param.security_domain = endpoint @@ -34934,7 +35428,7 @@ action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 via O action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "confidence": 50, "cve": ["CVE-2021-3156"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit action.notable.param.rule_title = Detect Baron Samedit CVE-2021-3156 via OSQuery action.notable.param.security_domain = endpoint @@ -35020,7 +35514,7 @@ action.correlationsearch.label = ESCU - Detect Outlook exe writing a zip file - action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. action.notable.param.rule_title = Detect Outlook exe writing a zip file action.notable.param.security_domain = network @@ -35106,7 +35600,7 @@ action.correlationsearch.label = ESCU - Detection of tools built by NirSoft - Ru action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 3"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for specific command-line arguments that may indicate the execution of tools made by Nirsoft, which are legitimate, but may be abused by attackers. action.notable.param.rule_title = Detection of tools built by NirSoft action.notable.param.security_domain = endpoint @@ -35160,7 +35654,7 @@ action.correlationsearch.label = ESCU - Exchange PowerShell Abuse via SSRF - Rul action.correlationsearch.annotations = {"analytic_story": ["ProxyShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. \ Modification of this analytic is requried to ensure fields are mapped accordingly. \ A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.json`. This is indicative of accessing PowerShell on the back end of Exchange with SSRF. \ @@ -35216,7 +35710,7 @@ action.correlationsearch.label = ESCU - Exchange PowerShell Module Usage - Rule action.correlationsearch.annotations = {"analytic_story": ["ProxyShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits. \ Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \ Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \ @@ -35315,6 +35809,46 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | lookup previously_seen_running_windows_services service as service OUTPUT firstTimeSeen | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), `previously_seen_windows_services_window`) | table _time dest service | `first_time_seen_running_windows_service_filter` +[ESCU - Linux Stdout Redirection To Dev Null File - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2022-04-05 +action.escu.modification_date = 2022-04-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Linux Stdout Redirection To Dev Null File - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cyclops BLink", "Industroyer2"] +action.risk = 1 +action.risk.param._risk_message = a commandline $process$ that redirect stdout to dev/null in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Linux Stdout Redirection To Dev Null File - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cyclops BLink", "Industroyer2"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*&>/dev/null*" by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stdout_redirection_to_dev_null_file_filter` + [ESCU - MacOS - Re-opened Applications - Rule] action.escu = 0 action.escu.enabled = 1 @@ -35345,7 +35879,7 @@ action.correlationsearch.label = ESCU - MacOS - Re-opened Applications - Rule action.correlationsearch.annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 8"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Installation", "Command \u0026 Control"], "nist": ["DE.DP", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for processes referencing the plist files that determine which applications are re-opened when a user reboots their machine. action.notable.param.rule_title = MacOS - Re-opened Applications action.notable.param.security_domain = threat @@ -35391,7 +35925,7 @@ action.correlationsearch.label = ESCU - MS Exchange Mailbox Replication service action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. action.notable.param.rule_title = MS Exchange Mailbox Replication service writing Active Server Pages action.notable.param.security_domain = endpoint @@ -35437,7 +35971,7 @@ action.correlationsearch.label = ESCU - Print Processor Registry Autostart - Rul action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. action.notable.param.rule_title = Print Processor Registry Autostart action.notable.param.security_domain = endpoint @@ -35483,7 +36017,7 @@ action.correlationsearch.label = ESCU - Processes Tapping Keyboard Events - Rule action.correlationsearch.annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input action.notable.param.rule_title = Processes Tapping Keyboard Events action.notable.param.security_domain = threat @@ -35689,7 +36223,7 @@ action.correlationsearch.label = ESCU - Sunburst Correlation DLL and Network Eve action.correlationsearch.annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 6", "CIS 8"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost.exe. After a period of 12-14 days, the malware will attempt to resolve a subdomain of avsvmcloud.com. This detections will correlate both events. action.notable.param.rule_title = Sunburst Correlation DLL and Network Event action.notable.param.security_domain = endpoint @@ -35735,7 +36269,7 @@ action.correlationsearch.label = ESCU - Suspicious Curl Network Connection - Rul action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow", "Ingress Tool Transfer"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants. In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. This particular behavior is common with MacOS adware-malicious software. action.notable.param.rule_title = Suspicious Curl Network Connection action.notable.param.security_domain = endpoint @@ -35795,7 +36329,7 @@ action.correlationsearch.label = ESCU - Suspicious PlistBuddy Usage - Rule action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\ - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \ @@ -35862,7 +36396,7 @@ action.correlationsearch.label = ESCU - Suspicious PlistBuddy Usage via OSquery action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\ - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \ @@ -35915,7 +36449,7 @@ action.correlationsearch.label = ESCU - Suspicious SQLite3 LSQuarantine Behavior action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1074"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the use of a SQLite3 querying the MacOS preferences to identify the original URL the pkg was downloaded from. This particular behavior is common with MacOS adware-malicious software. Upon triage, review other processes in parallel for suspicious activity. Identify any recent package installations. action.notable.param.rule_title = Suspicious SQLite3 LSQuarantine Behavior action.notable.param.security_domain = endpoint @@ -36125,7 +36659,7 @@ action.correlationsearch.label = ESCU - Windows Java Spawning Shells - Rule action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the process name of java.exe and w3wp.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy. action.notable.param.rule_title = Windows Java Spawning Shells action.notable.param.security_domain = endpoint @@ -36171,7 +36705,7 @@ action.correlationsearch.label = ESCU - WinRM Spawning a Process - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 50, "cve": ["CVE-2021-31166"], "impact": 50, "kill_chain_phases": ["Exploitation", "Actions on Objectives"], "mitre_attack": ["T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies suspicious processes spawning from WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. which is a kernel-mode device driver http.sys vulnerability. Current proof of concept code will blue-screen the operating system. However, http.sys used by many different Windows processes, including WinRM. In this case, identifying suspicious process create (child processes) from `wsmprovhost.exe` is what this analytic is identifying. action.notable.param.rule_title = WinRM Spawning a Process action.notable.param.security_domain = endpoint @@ -36217,7 +36751,7 @@ action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the creation of WMI permanent event subscriptions. action.notable.param.rule_title = WMI Permanent Event Subscription action.notable.param.security_domain = endpoint @@ -36263,7 +36797,7 @@ action.correlationsearch.label = ESCU - WMI Temporary Event Subscription - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for the creation of WMI temporary event subscriptions. action.notable.param.rule_title = WMI Temporary Event Subscription action.notable.param.security_domain = endpoint @@ -36309,7 +36843,7 @@ action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. action.notable.param.rule_title = Detect ARP Poisoning action.notable.param.security_domain = network @@ -36355,7 +36889,7 @@ action.correlationsearch.label = ESCU - Detect IPv6 Network Infrastructure Threa action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. action.notable.param.rule_title = Detect IPv6 Network Infrastructure Threats action.notable.param.security_domain = network @@ -36401,7 +36935,7 @@ action.correlationsearch.label = ESCU - Detect Large Outbound ICMP Packets - Rul action.correlationsearch.annotations = {"analytic_story": ["Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity. action.notable.param.rule_title = Detect Large Outbound ICMP Packets action.notable.param.security_domain = network @@ -36447,7 +36981,7 @@ action.correlationsearch.label = ESCU - Detect Outbound SMB Traffic - Rule action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "mitre_attack": ["T1071.002", "T1071"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. action.notable.param.rule_title = Detect Outbound SMB Traffic action.notable.param.security_domain = network @@ -36493,7 +37027,7 @@ action.correlationsearch.label = ESCU - Detect Port Security Violation - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. action.notable.param.rule_title = Detect Port Security Violation action.notable.param.security_domain = network @@ -36539,7 +37073,7 @@ action.correlationsearch.label = ESCU - Detect Rogue DHCP Server - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack). action.notable.param.rule_title = Detect Rogue DHCP Server action.notable.param.security_domain = network @@ -36585,7 +37119,7 @@ action.correlationsearch.label = ESCU - Detect SNICat SNI Exfiltration - Rule action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["PR.DS", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for commands that the SNICat tool uses in the TLS SNI field. action.notable.param.rule_title = Detect SNICat SNI Exfiltration action.notable.param.security_domain = network @@ -36631,7 +37165,7 @@ action.correlationsearch.label = ESCU - Detect Software Download To Network Devi action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005", "T1542"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. action.notable.param.rule_title = Detect Software Download To Network Device action.notable.param.security_domain = network @@ -36677,7 +37211,7 @@ action.correlationsearch.label = ESCU - Detect Traffic Mirroring - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1020", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. action.notable.param.rule_title = Detect Traffic Mirroring action.notable.param.security_domain = network @@ -36723,7 +37257,7 @@ action.correlationsearch.label = ESCU - Detect Unauthorized Assets by MAC addres action.correlationsearch.annotations = {"analytic_story": ["Asset Tracking"], "cis20": ["CIS 1"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found. action.notable.param.rule_title = Detect Unauthorized Assets by MAC address action.notable.param.security_domain = network @@ -36769,7 +37303,7 @@ action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Splunk Str action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "confidence": 50, "cve": ["CVE-2020-1350"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects SIGRed via Splunk Stream. action.notable.param.rule_title = Detect Windows DNS SIGRed via Splunk Stream action.notable.param.security_domain = network @@ -36815,7 +37349,7 @@ action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Zeek - Rul action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "cve": ["CVE-2020-1350"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects SIGRed via Zeek DNS and Zeek Conn data. action.notable.param.rule_title = Detect Windows DNS SIGRed via Zeek action.notable.param.security_domain = endpoint @@ -36861,7 +37395,7 @@ action.correlationsearch.label = ESCU - Detect Zerologon via Zeek - Rule action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "confidence": 50, "cve": ["CVE-2020-1472"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC action.notable.param.rule_title = Detect Zerologon via Zeek action.notable.param.security_domain = network @@ -37073,7 +37607,7 @@ action.correlationsearch.label = ESCU - Prohibited Network Traffic Allowed - Rul action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery", "Command \u0026 Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for network traffic defined by port and transport layer protocol in the Enterprise Security lookup table "lookup_interesting_ports", that is marked as prohibited, and has an associated 'allow' action in the Network_Traffic data model. This could be indicative of a misconfigured network device. action.notable.param.rule_title = Prohibited Network Traffic Allowed action.notable.param.security_domain = network @@ -37159,7 +37693,7 @@ action.correlationsearch.label = ESCU - Protocols passing authentication in clea action.correlationsearch.annotations = {"analytic_story": ["Use of Cleartext Protocols"], "cis20": ["CIS 9", "CIS 14"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies cleartext protocols at risk of leaking sensitive information. Currently, this consists of legacy protocols such as telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21) sessions. While some of these protocols may be used over SSL, they typically are found on different assigned ports in those instances. action.notable.param.rule_title = Protocols passing authentication in cleartext action.notable.param.security_domain = network @@ -37205,7 +37739,7 @@ action.correlationsearch.label = ESCU - Remote Desktop Network Bruteforce - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic. action.notable.param.rule_title = Remote Desktop Network Bruteforce action.notable.param.security_domain = network @@ -37374,7 +37908,7 @@ action.correlationsearch.label = ESCU - TOR Traffic - Rule action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "NOBELIUM Group", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. action.notable.param.rule_title = TOR Traffic action.notable.param.security_domain = network @@ -37460,7 +37994,7 @@ action.correlationsearch.label = ESCU - Detect attackers scanning for vulnerable action.correlationsearch.annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for specific GET or HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. JexBoss is described as the exploit tool of choice for this malicious activity. action.notable.param.rule_title = Detect attackers scanning for vulnerable JBoss servers action.notable.param.security_domain = network @@ -37506,7 +38040,7 @@ action.correlationsearch.label = ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule action.correlationsearch.annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 8", "CIS 11"], "confidence": 50, "cve": ["CVE-2020-5902"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices action.notable.param.rule_title = Detect F5 TMUI RCE CVE-2020-5902 action.notable.param.security_domain = network @@ -37552,7 +38086,7 @@ action.correlationsearch.label = ESCU - Detect malicious requests to exploit JBo action.correlationsearch.annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "cis20": ["CIS 12", "CIS 4", "CIS 18"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is used to detect malicious HTTP requests crafted to exploit jmx-console in JBoss servers. The malicious requests have a long URL length, as the payload is embedded in the URL. action.notable.param.rule_title = Detect malicious requests to exploit JBoss servers action.notable.param.security_domain = network @@ -37598,7 +38132,7 @@ action.correlationsearch.label = ESCU - Monitor Web Traffic For Brand Abuse - Ru action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring"], "cis20": ["CIS 7"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"], "observable": [{"name": "src", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse. action.notable.param.rule_title = Monitor Web Traffic For Brand Abuse action.notable.param.security_domain = network @@ -37644,7 +38178,7 @@ action.correlationsearch.label = ESCU - SQL Injection with Long URLs - Rule action.correlationsearch.annotations = {"analytic_story": ["SQL Injection"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for long URLs that have several SQL commands visible within them. action.notable.param.rule_title = SQL Injection with Long URLs action.notable.param.security_domain = network @@ -37690,7 +38224,7 @@ action.correlationsearch.label = ESCU - Supernova Webshell - Rule action.correlationsearch.annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search aims to detect the Supernova webshell used in the SUNBURST attack. action.notable.param.rule_title = Supernova Webshell action.notable.param.security_domain = network @@ -37742,7 +38276,7 @@ action.correlationsearch.label = ESCU - Detect hosts connecting to dynamic domai action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, block lists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. action.notable.param.rule_title = Detect hosts connecting to dynamic domain providers action.notable.param.security_domain = network @@ -37868,7 +38402,7 @@ action.correlationsearch.label = ESCU - Multiple Archive Files Http Post Traffic action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration", "Command and Control"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "URL"}, {"name": "form_data", "role": ["Attacker"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. action.notable.param.rule_title = Multiple Archive Files Http Post Traffic action.notable.param.security_domain = network @@ -37914,7 +38448,7 @@ action.correlationsearch.label = ESCU - Plain HTTP POST Exfiltrated Data - Rule action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration", "Command and Control"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "URL"}, {"name": "form_data", "role": ["Attacker"], "type": "Other"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. action.notable.param.rule_title = Plain HTTP POST Exfiltrated Data action.notable.param.security_domain = network @@ -38040,7 +38574,7 @@ action.correlationsearch.label = ESCU - Spring4Shell Payload URL Request - Rule action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Scope:Network"], "cve": ["CVE-2022-22965"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity. action.notable.param.rule_title = Spring4Shell Payload URL Request action.notable.param.security_domain = network @@ -38086,7 +38620,7 @@ action.correlationsearch.label = ESCU - Web JSP Request via URL - Rule action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Scope:Network"], "cve": ["CVE-2022-22965"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity. action.notable.param.rule_title = Web JSP Request via URL action.notable.param.security_domain = network @@ -38132,7 +38666,7 @@ action.correlationsearch.label = ESCU - Web Spring4Shell HTTP Request Class Modu action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Scope:Network"], "cve": ["CVE-2022-22965"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies the payload related to Spring4Shell, CVE-2022-22965. This analytic uses Splunk Stream HTTP to view the http request body, form data. STRT reviewed all the current proof of concept code and determined the commonality with the payloads being passed used the same fields "class.module.classLoader.resources.context.parent.pipeline.first". action.notable.param.rule_title = Web Spring4Shell HTTP Request Class Module action.notable.param.security_domain = network @@ -38178,7 +38712,7 @@ action.correlationsearch.label = ESCU - Web Spring Cloud Function FunctionRouter action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Scope:Network"], "cve": ["CVE-2022-22963"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = [] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = The following analytic identifies activity related to the web application Spring Cloud Function that was recently idenfied as vulnerable. This is CVE-2022-22963. Multiple proof of concept code was released. The URI that is hit includes `functionrouter`. The specifics of the exploit include a status of 500. In this query we did not include it, but for filtering you can add Web.status=500. The exploit data itself (based on all the POCs) is located in the form_data field. This field will include all class.modules being called. action.notable.param.rule_title = Web Spring Cloud Function FunctionRouter action.notable.param.security_domain = network diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 1a1cfc0ff9..99b730a545 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 46a3a2b0b7..cb0504e0f5 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-04-14T21:50:31 UTC +# On Date: 2022-05-02T22:16:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index 2719dde5e6..98e157fb74 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,18 +1,30 @@ mitre_id,technique,tactics,groups +T1647,Plist File Modification,Defense Evasion,no +T1622,Debugger Evasion,Defense Evasion|Discovery,no +T1621,Multi-Factor Authentication Request Generation,Credential Access,APT29 +T1505.005,Terminal Services DLL,Persistence,no +T1557.003,DHCP Spoofing,Credential Access|Collection,no +T1595.003,Wordlist Scanning,Reconnaissance,Volatile Cedar +T1098.005,Device Registration,Persistence,APT29 +T1574.013,KernelCallbackTable,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group +T1556.005,Reversible Encryption,Credential Access|Defense Evasion|Persistence,no +T1055.015,ListPlanting,Defense Evasion|Privilege Escalation,no +T1564.010,Process Argument Spoofing,Defense Evasion,no T1564.009,Resource Forking,Defense Evasion,no +T1559.003,XPC Services,Execution,no T1562.010,Downgrade Attack,Defense Evasion,no T1547.015,Login Items,Persistence|Privilege Escalation,no -T1620,Reflective Code Loading,Defense Evasion,no +T1620,Reflective Code Loading,Defense Evasion,Lazarus Group T1619,Cloud Storage Object Discovery,Discovery,no T1218.014,MMC,Defense Evasion,no T1218.013,Mavinject,Defense Evasion,no -T1614.001,System Language Discovery,Discovery,no +T1614.001,System Language Discovery,Discovery,Ke3chang|Lazarus Group T1615,Group Policy Discovery,Discovery,Turla T1036.007,Double File Extension,Defense Evasion,Mustang Panda T1562.009,Safe Mode Boot,Defense Evasion,no T1564.008,Email Hiding Rules,Defense Evasion,FIN4 T1505.004,IIS Components,Persistence,no -T1027.006,HTML Smuggling,Defense Evasion,no +T1027.006,HTML Smuggling,Defense Evasion,APT29 T1213.003,Code Repositories,Collection,APT29 T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 T1614,System Location Discovery,Discovery,no @@ -25,14 +37,14 @@ T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation T1610,Deploy Container,Defense Evasion|Execution,TeamTNT T1609,Container Administration Command,Execution,TeamTNT T1608.005,Link Target,Resource Development,Silent Librarian -T1608.004,Drive-by Target,Resource Development,Transparent Tribe|APT32|Threat Group-3390 +T1608.004,Drive-by Target,Resource Development,Dragonfly|Transparent Tribe|APT32|Threat Group-3390 T1608.003,Install Digital Certificate,Resource Development,no -T1608.002,Upload Tool,Resource Development,Threat Group-3390 -T1608.001,Upload Malware,Resource Development,TeamTNT|APT32 -T1608,Stage Capabilities,Resource Development,no -T1016.001,Internet Connection Discovery,Discovery,APT29|Turla -T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 -T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao +T1608.002,Upload Tool,Resource Development,Lazarus Group|Threat Group-3390 +T1608.001,Upload Malware,Resource Development,Threat Group-3390|LazyScripter|Mustang Panda|Gamaredon Group|Kimsuky|Lazarus Group|TeamTNT|APT32 +T1608,Stage Capabilities,Resource Development,Mustang Panda +T1016.001,Internet Connection Discovery,Discovery,Gamaredon Group|APT29|Turla +T1553.005,Mark-of-the-Web Bypass,Defense Evasion,APT29|TA505 +T1555.005,Password Managers,Credential Access,Threat Group-3390|Fox Kitten|Operation Wocao T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29 T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider T1547.014,Active Setup,Persistence|Privilege Escalation,no @@ -61,8 +73,8 @@ T1588.006,Vulnerabilities,Resource Development,Sandworm Team T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no T1562.008,Disable Cloud Logs,Defense Evasion,no T1547.012,Print Processors,Persistence|Privilege Escalation,no -T1598.003,Spearphishing Link,Reconnaissance,Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky -T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder +T1598.003,Spearphishing Link,Reconnaissance,APT28|Dragonfly|Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky +T1598.002,Spearphishing Attachment,Reconnaissance,Dragonfly|Sidewinder T1598.001,Spearphishing Service,Reconnaissance,no T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 T1597.002,Purchase Technical Data,Reconnaissance,no @@ -74,23 +86,23 @@ T1596.003,Digital Certificates,Reconnaissance,no T1596.001,DNS/Passive DNS,Reconnaissance,no T1596.002,WHOIS,Reconnaissance,no T1596,Search Open Technical Databases,Reconnaissance,no -T1595.002,Vulnerability Scanning,Reconnaissance,TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team +T1595.002,Vulnerability Scanning,Reconnaissance,Magic Hound|Aquatic Panda|Dragonfly|TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team T1595.001,Scanning IP Blocks,Reconnaissance,TeamTNT T1595,Active Scanning,Reconnaissance,no -T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team -T1593.002,Search Engines,Reconnaissance,no -T1593.001,Social Media,Reconnaissance,Kimsuky +T1594,Search Victim-Owned Websites,Reconnaissance,Kimsuky|Silent Librarian|Sandworm Team +T1593.002,Search Engines,Reconnaissance,Kimsuky +T1593.001,Social Media,Reconnaissance,Lazarus Group|Kimsuky T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team T1592.004,Client Configurations,Reconnaissance,HAFNIUM T1592.003,Firmware,Reconnaissance,no T1592.002,Software,Reconnaissance,Andariel|Sandworm Team T1592.001,Hardware,Reconnaissance,no T1592,Gather Victim Host Information,Reconnaissance,no -T1591.004,Identify Roles,Reconnaissance,no +T1591.004,Identify Roles,Reconnaissance,Lazarus Group T1591.003,Identify Business Tempo,Reconnaissance,no T1591.001,Determine Physical Locations,Reconnaissance,no -T1591.002,Business Relationships,Reconnaissance,Sandworm Team -T1591,Gather Victim Org Information,Reconnaissance,no +T1591.002,Business Relationships,Reconnaissance,Dragonfly|Sandworm Team +T1591,Gather Victim Org Information,Reconnaissance,Kimsuky|Lazarus Group T1590.006,Network Security Appliances,Reconnaissance,no T1590.005,IP Addresses,Reconnaissance,Andariel|HAFNIUM T1590.004,Network Topology,Reconnaissance,no @@ -98,40 +110,40 @@ T1590.003,Network Trust Dependencies,Reconnaissance,no T1590.002,DNS,Reconnaissance,no T1590.001,Domain Properties,Reconnaissance,Sandworm Team T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM -T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team -T1589.002,Email Addresses,Reconnaissance,Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team -T1589.001,Credentials,Reconnaissance,Leviathan|APT28|Magic Hound|Chimera +T1589.003,Employee Names,Reconnaissance,Kimsuky|Silent Librarian|Sandworm Team +T1589.002,Email Addresses,Reconnaissance,Lazarus Group|Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team +T1589.001,Credentials,Reconnaissance,APT29|Leviathan|APT28|Magic Hound|Chimera T1589,Gather Victim Identity Information,Reconnaissance,Magic Hound|APT32 -T1588.005,Exploits,Resource Development,no -T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian -T1588.003,Code Signing Certificates,Resource Development,Wizard Spider -T1588.002,Tool,Resource Development,CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team -T1588.001,Malware,Resource Development,Andariel|BackdoorDiplomacy|Turla|APT1 +T1588.005,Exploits,Resource Development,Kimsuky +T1588.004,Digital Certificates,Resource Development,BlackTech|Lazarus Group|Silent Librarian +T1588.003,Code Signing Certificates,Resource Development,BlackTech|Lazarus Group|Wizard Spider +T1588.002,Tool,Resource Development,Aquatic Panda|BlackTech|Lazarus Group|CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team +T1588.001,Malware,Resource Development,Aquatic Panda|LazyScripter|Andariel|BackdoorDiplomacy|Turla|APT1 T1588,Obtain Capabilities,Resource Development,no T1587.004,Exploits,Resource Development,no T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork -T1587.001,Malware,Resource Development,TeamTNT|APT29|Lazarus Group|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver +T1587.001,Malware,Resource Development,Ke3chang|Kimsuky|TeamTNT|APT29|Lazarus Group|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver T1587,Develop Capabilities,Resource Development,Kimsuky -T1586.002,Email Accounts,Resource Development,IndigoZebra|Leviathan|Magic Hound|Kimsuky +T1586.002,Email Accounts,Resource Development,APT29|APT28|IndigoZebra|Leviathan|Magic Hound|Kimsuky T1586.001,Social Media Accounts,Resource Development,Leviathan T1586,Compromise Accounts,Resource Development,no -T1585.002,Email Accounts,Resource Development,Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1 -T1585.001,Social Media Accounts,Resource Development,Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver +T1585.002,Email Accounts,Resource Development,Mustang Panda|Kimsuky|Lazarus Group|Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1 +T1585.001,Social Media Accounts,Resource Development,Kimsuky|Lazarus Group|Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 T1584.006,Web Services,Resource Development,Turla -T1584.005,Botnet,Resource Development,no -T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 +T1584.005,Botnet,Resource Development,Sandworm Team|Axiom +T1584.004,Server,Resource Development,Lazarus Group|Dragonfly|Indrik Spider|Turla|APT16 T1584.003,Virtual Private Server,Resource Development,Turla T1584.002,DNS Server,Resource Development,no -T1584.001,Domains,Resource Development,Transparent Tribe|Magic Hound|APT29|APT1 -T1583.006,Web Services,Resource Development,IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 +T1584.001,Domains,Resource Development,Kimsuky|Lazarus Group|Transparent Tribe|Magic Hound|APT29|APT1 +T1583.006,Web Services,Resource Development,APT28|Confucius|LazyScripter|Kimsuky|Magic Hound|IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,GALLIUM|Sandworm Team -T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles -T1583.002,DNS Server,Resource Development,no +T1583.004,Server,Resource Development,Kimsuky|Lazarus Group|Gelsemium|GALLIUM|Sandworm Team +T1583.003,Virtual Private Server,Resource Development,Axiom|Dragonfly|HAFNIUM|TEMP.Veles +T1583.002,DNS Server,Resource Development,Axiom T1584,Compromise Infrastructure,Resource Development,no -T1583.001,Domains,Resource Development,IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 +T1583.001,Domains,Resource Development,LazyScripter|Gamaredon Group|Winnti Group|Dragonfly|IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 T1583,Acquire Infrastructure,Resource Development,no T1564.007,VBA Stomping,Defense Evasion,no T1558.004,AS-REP Roasting,Credential Access,no @@ -145,7 +157,7 @@ T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Moc T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,TeamTNT T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript,Execution,Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript,Execution,LazyScripter|Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no @@ -155,14 +167,14 @@ T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|T T1562.006,Indicator Blocking,Defense Evasion,no T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group -T1573,Encrypted Channel,Command And Control,Tropic Trooper +T1573,Encrypted Channel,Command And Control,APT29|Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.004,DNS,Command And Control,LazyScripter|Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon +T1071.001,Web Protocols,Command And Control,Kimsuky|Confucius|TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon T1572,Protocol Tunneling,Command And Control,Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|APT29 @@ -175,23 +187,23 @@ T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Trop T1090.004,Domain Fronting,Command And Control,APT29 T1090.003,Multi-hop Proxy,Command And Control,Leviathan|CostaRicto|APT28|Operation Wocao|Inception|FIN4|APT29 T1090.002,External Proxy,Command And Control,Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|Operation Wocao|APT39|Strider +T1090.001,Internal Proxy,Command And Control,Lazarus Group|Turla|APT29|Higaisa|Operation Wocao|APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Kimsuky|Lazarus Group|ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork -T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 +T1571,Non-Standard Port,Command And Control,WIRTE|Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 T1074.002,Remote Data Staging,Collection,Leviathan|APT28|APT29|Chimera|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 -T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT28|APT33 +T1074.001,Local Data Staging,Collection,Dragonfly|Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|APT29|APT28|APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|APT32 +T1564.003,Hidden Window,Defense Evasion,Gamaredon Group|Kimsuky|Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|APT32 T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no -T1564.002,Hidden Users,Defense Evasion,Dragonfly 2.0 +T1564.002,Hidden Users,Defense Evasion,Kimsuky|Dragonfly|Dragonfly 2.0 T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group|Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Aquatic Panda|BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -202,10 +214,10 @@ T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no T1069.001,Local Groups,Discovery,Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338 T1570,Lateral Tool Transfer,Lateral Movement,Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood -T1204.001,Malicious Link,Execution,FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 +T1204.002,Malicious File,Execution,LazyScripter|WIRTE|Confucius|Dragonfly|Threat Group-3390|Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood +T1204.001,Malicious Link,Execution,LazyScripter|Kimsuky|Lazarus Group|Confucius|FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Gelsemium|Threat Group-3390|APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper @@ -213,65 +225,65 @@ T1569.002,Service Execution,Execution,APT38|Chimera|Operation Wocao|Wizard Spide T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,Transparent Tribe|APT29 +T1568,Dynamic Resolution,Command And Control,Gamaredon Group|Gelsemium|Transparent Tribe|APT29 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,Kimsuky|Threat Group-3390|Confucius|Lazarus Group|FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Dragonfly|Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,Confucius|Lazarus Group|LazyScripter|OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,TeamTNT|Rocke|APT41 -T1059.003,Windows Command Shell,Execution,Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,Kimsuky|Aquatic Panda|Dragonfly|LazyScripter|Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1059.001,PowerShell,Execution,Gamaredon Group|Lazarus Group|Aquatic Panda|Confucius|Dragonfly|LazyScripter|Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda T1567,Exfiltration Over Web Service,Exfiltration,APT28 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,OilRig|Darkhotel|Evilnum|Frankenstein +T1497.001,System Checks,Defense Evasion|Discovery,Lazarus Group|OilRig|Darkhotel|Evilnum|Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM -T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly +T1566.003,Spearphishing via Service,Initial Access,Lazarus Group|APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Lazarus Group|Confucius|LazyScripter|Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound +T1566.001,Spearphishing Attachment,Initial Access,WIRTE|Confucius|Dragonfly|LazyScripter|Threat Group-3390|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM +T1566,Phishing,Initial Access,Axiom|GOLD SOUTHFIELD|Dragonfly T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,APT38 T1565,Data Manipulation,Impact,no T1564.001,Hidden Files and Directories,Defense Evasion,Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group T1564,Hide Artifacts,Defense Evasion,no -T1563.002,RDP Hijacking,Lateral Movement,no +T1563.002,RDP Hijacking,Lateral Movement,Axiom T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Kimsuky|Aquatic Panda|TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang -T1087.004,Cloud Account,Discovery,no +T1069.002,Domain Groups,Discovery,APT29|Dragonfly|Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1087.004,Cloud Account,Discovery,APT29 T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.002,Domain Account,Discovery,APT29|Lazarus Group|Dragonfly|MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.004,Disable or Modify System Firewall,Defense Evasion,Dragonfly|TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak T1562.003,Impair Command History Logging,Defense Evasion,APT38 T1562.002,Disable Windows Event Logging,Defense Evasion,Sandworm Team|APT29|Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,TeamTNT|Indrik Spider|APT29|MuddyWater|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.001,Disable or Modify Tools,Defense Evasion,Aquatic Panda|TeamTNT|Indrik Spider|APT29|MuddyWater|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no -T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 +T1003.004,LSA Secrets,Credential Access,Dragonfly|OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang -T1560,Archive Collected Data,Collection,Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang +T1560.001,Archive via Utility,Collection,Kimsuky|Aquatic Panda|APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang +T1560,Archive Collected Data,Collection,Axiom|Dragonfly|Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no T1491.002,External Defacement,Impact,Sandworm Team -T1491.001,Internal Defacement,Impact,Lazarus Group +T1491.001,Internal Defacement,Impact,Gamaredon Group|Lazarus Group T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 +T1114.002,Remote Email Collection,Collection,Kimsuky|Dragonfly|APT29|HAFNIUM|Chimera|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no @@ -280,7 +292,7 @@ T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|L T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,FIN8|APT28 T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,APT29|Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no T1559.002,Dynamic Data Exchange,Execution,Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|FIN7|APT28 @@ -289,7 +301,7 @@ T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Lazarus Group|Wizard Spider T1557,Adversary-in-the-Middle,Credential Access|Collection,Kimsuky T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera @@ -305,32 +317,32 @@ T1003.007,Proc Filesystem,Credential Access,no T1003.006,DCSync,Credential Access,APT29|Operation Wocao T1558.003,Kerberoasting,Credential Access,FIN7|APT29|Operation Wocao|Wizard Spider T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1003.003,NTDS,Credential Access,Ke3chang|Dragonfly|APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Dragonfly|Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,Aquatic Panda|Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver T1110.004,Credential Stuffing,Credential Access,Chimera T1110.003,Password Spraying,Credential Access,Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 +T1110.002,Password Cracking,Credential Access,Dragonfly|FIN6|APT41|Dragonfly 2.0|APT3 T1110.001,Password Guessing,Credential Access,APT28 T1021.006,Windows Remote Management,Lateral Movement,APT29|Chimera|Wizard Spider|Threat Group-3390 -T1021.005,VNC,Lateral Movement,FIN7|Fox Kitten|GCMAN -T1021.004,SSH,Lateral Movement,TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1021.005,VNC,Lateral Movement,Gamaredon Group|FIN7|Fox Kitten|GCMAN +T1021.004,SSH,Lateral Movement,BlackTech|Lazarus Group|TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,APT29|Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,APT29|Dragonfly|Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,Ke3chang|Kimsuky|Gamaredon Group|WIRTE|APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,Lazarus Group|BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,Lazarus Group|menuPass|APT32|GALLIUM T1036.002,Right-to-Left Override,Defense Evasion,Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Lazarus Group|menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no -T1553,Subvert Trust Controls,Defense Evasion,no +T1553,Subvert Trust Controls,Defense Evasion,Axiom T1027.003,Steganography,Defense Evasion,Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.002,Software Packing,Defense Evasion,Threat Group-3390|Lazarus Group|Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon T1027.001,Binary Padding,Defense Evasion,APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,TeamTNT|Rocke|APT32 T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider @@ -342,10 +354,10 @@ T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 T1070.006,Timestomp,Defense Evasion,APT38|APT29|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 -T1070.003,Clear Command History,Defense Evasion,TeamTNT|menuPass|APT41 +T1070.004,File Deletion,Defense Evasion,Aquatic Panda|Dragonfly|TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 +T1070.003,Clear Command History,Defense Evasion,Lazarus Group|TeamTNT|menuPass|APT41 T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29 -T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 +T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT29|APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29 @@ -354,14 +366,14 @@ T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Threat Group-3390|Honeybee|Cobalt Group|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no -T1136.003,Cloud Account,Persistence,no +T1136.003,Cloud Account,Persistence,APT29 T1070.002,Clear Linux or Mac System Logs,Defense Evasion,TeamTNT|Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1070.001,Clear Windows Event Logs,Defense Evasion,Dragonfly|Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 T1136.002,Domain Account,Persistence,Sandworm Team|HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 +T1136.001,Local Account,Persistence,Kimsuky|Dragonfly|TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,Dragonfly|APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no @@ -385,18 +397,18 @@ T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,FIN8|Mustang Panda|APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Confucius|Dragonfly|LazyScripter|TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,Kimsuky|Lazarus Group|TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.005,Mshta,Defense Evasion,Gamaredon Group|Confucius|Lazarus Group|APT29|LazyScripter|Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass -T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Dark Caracal|OilRig|Lazarus Group +T1218.001,Compiled HTML File,Defense Evasion,APT38|APT41|Silence|Dark Caracal|OilRig|Lazarus Group T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,APT38|HAFNIUM|TA551|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,Kimsuky|Lazarus Group|LazyScripter|APT38|HAFNIUM|TA551|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no -T1098.003,Add Office 365 Global Administrator Role,Persistence,no +T1098.003,Add Office 365 Global Administrator Role,Persistence,APT29 T1098.002,Exchange Email Delegate Permissions,Persistence,APT28|APT29|Magic Hound T1098.001,Additional Cloud Credentials,Persistence,APT29 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no @@ -405,7 +417,7 @@ T1543.002,Systemd Service,Persistence|Privilege Escalation,TeamTNT|Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Kimsuky|Threat Group-3390|menuPass|Gorgon Group|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -423,12 +435,12 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Dragonfly|BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,Sandworm Team T1053.003,Cron,Execution|Persistence|Privilege Escalation,APT38|Rocke T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Kimsuky|Lazarus Group|Confucius|Dragonfly|APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -438,11 +450,11 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,Evilnum +T1539,Steal Web Session Cookie,Credential Access,APT29|Evilnum T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no -T1534,Internal Spearphishing,Lateral Movement,Leviathan|Gamaredon Group +T1534,Internal Spearphishing,Lateral Movement,Kimsuky|Lazarus Group|Leviathan|Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no T1525,Implant Internal Image,Persistence,no @@ -461,42 +473,42 @@ T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no T1489,Service Stop,Impact,Indrik Spider|Wizard Spider|Lazarus Group T1486,Data Encrypted for Impact,Impact,FIN7|Indrik Spider|APT41|TA505|APT38 -T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 +T1485,Data Destruction,Impact,Gamaredon Group|Sandworm Team|Lazarus Group|APT38 T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no T1482,Domain Trust Discovery,Discovery,FIN8|APT29|Chimera T1480,Execution Guardrails,Defense Evasion,no -T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 +T1221,Template Injection,Defense Evasion,Lazarus Group|Confucius|Dragonfly|Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 T1222,File and Directory Permissions Modification,Defense Evasion,no -T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group +T1220,XSL Script Processing,Defense Evasion,Lazarus Group|Higaisa|Cobalt Group T1217,Browser Bookmark Discovery,Discovery,APT38|Chimera|Fox Kitten T1212,Exploitation for Credential Access,Credential Access,no -T1189,Drive-by Compromise,Initial Access,Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM +T1189,Drive-by Compromise,Initial Access,Magic Hound|APT28|Axiom|Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1203,Exploitation for Client Execution,Execution,Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan +T1203,Exploitation for Client Execution,Execution,Axiom|Confucius|Dragonfly|Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig T1195,Supply Chain Compromise,Initial Access,no -T1199,Trusted Relationship,Initial Access,APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,no +T1199,Trusted Relationship,Initial Access,Threat Group-3390|APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1218,Signed Binary Proxy Execution,Defense Evasion,Lazarus Group T1204,User Execution,Execution,no -T1213,Data from Information Repositories,Collection,APT28|Fox Kitten|FIN6|Turla -T1190,Exploit Public-Facing Application,Initial Access,BackdoorDiplomacy|menuPass|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 +T1213,Data from Information Repositories,Collection,APT29|APT28|Fox Kitten|FIN6|Turla +T1190,Exploit Public-Facing Application,Initial Access,Threat Group-3390|Ke3chang|Kimsuky|Magic Hound|Dragonfly|BackdoorDiplomacy|menuPass|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Dragonfly|Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 T1200,Hardware Additions,Initial Access,DarkVishnya -T1202,Indirect Command Execution,Defense Evasion,no +T1202,Indirect Command Execution,Defense Evasion,Lazarus Group T1219,Remote Access Software,Command And Control,TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Cobalt Group|Thrip|Carbanak T1207,Rogue Domain Controller,Defense Evasion,no T1216,Signed Script Proxy Execution,Defense Evasion,no T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky -T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 +T1187,Forced Authentication,Credential Access,Dragonfly|DarkHydrus|Dragonfly 2.0 T1185,Browser Session Hijacking,Collection,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Lazarus Group|Ke3chang|Kimsuky|APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird T1136,Create Account,Persistence,Sandworm Team|Indrik Spider -T1135,Network Share Discovery,Discovery,Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug +T1135,Network Share Discovery,Discovery,Dragonfly|Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1133,External Remote Services,Persistence|Initial Access,TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,Dragonfly|TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no @@ -504,64 +516,64 @@ T1125,Video Capture,Collection,Silence|FIN7 T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 T1120,Peripheral Device Discovery,Discovery,OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1119,Automated Collection,Collection,Ke3chang|Confucius|Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 T1114,Email Collection,Collection,Magic Hound|Silent Librarian -T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao -T1110,Brute Force,Credential Access,APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla -T1106,Native API,Execution,APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 -T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 -T1098,Account Manipulation,Persistence,Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group +T1113,Screen Capture,Collection,Dragonfly|GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Dragonfly|Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,Kimsuky|Chimera|Operation Wocao +T1110,Brute Force,Credential Access,Lazarus Group|Dragonfly|APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla +T1106,Native API,Execution,BlackTech|Lazarus Group|APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group +T1105,Ingress Tool Transfer,Command And Control,LazyScripter|Ke3chang|Aquatic Panda|Winnti Group|Confucius|Dragonfly|TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1104,Multi-Stage Channels,Command And Control,Lazarus Group|APT41|MuddyWater|APT3 +T1102,Web Service,Command And Control,Mustang Panda|LazyScripter|TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 +T1098,Account Manipulation,Persistence,Kimsuky|Dragonfly|Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group T1095,Non-Application Layer Protocol,Command And Control,BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,FIN7|Mustang Panda|Tropic Trooper|Darkhotel|APT28 T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla T1087,Account Discovery,Discovery,APT29 -T1083,File and Directory Discovery,Discovery,APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1083,File and Directory Discovery,Discovery,Winnti Group|Confucius|Dragonfly|APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Aquatic Panda|Confucius|TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|Lazarus Group|Axiom|Dragonfly|FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 -T1071,Application Layer Protocol,Command And Control,TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,APT29 +T1071,Application Layer Protocol,Command And Control,Dragonfly|TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 +T1070,Indicator Removal on Host,Defense Evasion,Lazarus Group|APT29 T1069,Permission Groups Discovery,Discovery,APT29|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 -T1059,Command and Scripting Interpreter,Execution,APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT29|Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1059,Command and Scripting Interpreter,Execution,Dragonfly|APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Gamaredon Group|Kimsuky|TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang T1056,Input Capture,Collection|Credential Access,APT39 T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no -T1049,System Network Connections Discovery,Discovery,TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Lazarus Group|TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1047,Windows Management Instrumentation,Execution,Gamaredon Group|Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,BlackTech|Lazarus Group|TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,Confucius|Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|APT28 T1039,Data from Network Shared Drive,Collection,APT28|Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 -T1033,System Owner/User Discovery,Discovery,APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1036,Masquerading,Defense Evasion,Kimsuky|Lazarus Group|Dragonfly|LazyScripter|APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 +T1033,System Owner/User Discovery,Discovery,Threat Group-3390|Ke3chang|Dragonfly|APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,APT28|Threat Group-3390 T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1027,Obfuscated Files or Information,Defense Evasion,Aquatic Panda|Ke3chang|LazyScripter|TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Ke3chang|Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,Dragonfly|Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Kimsuky|Dragonfly|TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,TeamTNT|Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,Kimsuky|Dragonfly|ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group T1008,Fallback Channels,Command And Control,FIN7|APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1007,System Service Discovery,Discovery,Kimsuky|Aquatic Panda|Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Axiom|Dragonfly|FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom diff --git a/dist/escu/lookups/prohibited_apps_launching_cmd.csv b/dist/escu/lookups/prohibited_apps_launching_cmd.csv index 5e4a2cf651..7ebd89b2b4 100644 --- a/dist/escu/lookups/prohibited_apps_launching_cmd.csv +++ b/dist/escu/lookups/prohibited_apps_launching_cmd.csv @@ -15,3 +15,4 @@ java.exe,prohibited powershell.exe,prohibited mshta.exe, prohibited zoom.exe,prohibitied +node.exe,prohibited diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index dbf2bc71f7..92363917b3 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -447,7 +447,7 @@ sidebar: | [Linux Install Kernel Module Using Modprobe Utility](/endpoint/linux_install_kernel_module_using_modprobe_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Iptables Firewall Modification](/endpoint/linux_iptables_firewall_modification/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Linux Kworker Process CommandLine](/endpoint/linux_kworker_process_commandline/) | [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Linux Kworker Process In Writable Process Path](/endpoint/linux_kworker_process_in_writable_process_path/) | [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux NOPASSWD Entry In Sudoers File](/endpoint/linux_nopasswd_entry_in_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Access Or Modification Of sshd Config File](/endpoint/linux_possible_access_or_modification_of_sshd_config_file/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -555,6 +555,7 @@ sidebar: | [Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Accessibility Features](/tags/#accessibility-features) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Password Policy Discovery with Net](/endpoint/password_policy_discovery_with_net/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [PetitPotam Suspicious Kerberos TGT Request](/endpoint/petitpotam_suspicious_kerberos_tgt_request/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -685,6 +686,8 @@ sidebar: | [Spike in File Writes]() | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk Enterprise Information Disclosure]() | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -692,7 +695,6 @@ sidebar: | [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spring4Shell Payload URL Request](/web/spring4shell_payload_url_request/) | [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Sqlite Module In Temp Folder](/endpoint/sqlite_module_in_temp_folder/) | [Data from Local System](/tags/#data-from-local-system) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Changes to File Associations](/deprecated/suspicious_changes_to_file_associations/) | [Change Default File Association](/tags/#change-default-file-association) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -794,6 +796,9 @@ sidebar: | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Computer Account Requesting Kerberos Ticket](/endpoint/windows_computer_account_requesting_kerberos_ticket/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Computer Account With SPN](/endpoint/windows_computer_account_with_spn/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -811,6 +816,7 @@ sidebar: | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Drivers Loaded by Signature](/endpoint/windows_drivers_loaded_by_signature/) | [Rootkit](/tags/#rootkit) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -819,6 +825,7 @@ sidebar: | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -829,6 +836,8 @@ sidebar: | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Invalid Users Failed Authentication via Kerberos](/endpoint/windows_invalid_users_failed_authentication_via_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Java Spawning Shells](/endpoint/windows_java_spawning_shells/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Kerberos Local Successful Logon](/endpoint/windows_kerberos_local_successful_logon/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows KrbRelayUp Service Creation](/endpoint/windows_krbrelayup_service_creation/) | [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -841,6 +850,9 @@ sidebar: | [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Raw Access To Disk Volume Partition](/endpoint/windows_raw_access_to_disk_volume_partition/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Raw Access To Master Boot Record Drive](/endpoint/windows_raw_access_to_master_boot_record_drive/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 10ed946870..1002857a7a 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -63,6 +63,7 @@ sidebar: | [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) | | [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) | | [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Data Destruction](/tags/#data-destruction), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Scheduled Task/Job](/tags/#scheduled-task/job), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | | [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [BITS Jobs](/tags/#bits-jobs) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) | | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | @@ -73,6 +74,7 @@ sidebar: | [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) | | [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Plist Modification](/tags/#plist-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Local Privilege Escalation With KrbRelayUp](local_privilege_escalation_with_krbrelayup) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Windows Service](/tags/#windows-service) | [Credential Access](/tags/#credential-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Windows Command Shell](/tags/#windows-command-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | @@ -101,9 +103,9 @@ sidebar: | [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [System Information Discovery](/tags/#system-information-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Reconnaissance](/tags/#reconnaissance) | | [Signed Binary Proxy Execution InstallUtil](signed_binary_proxy_execution_installutil) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) | | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link) | [Credential Access](/tags/#credential-access), [Initial Access](/tags/#initial-access) | +| [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Spectre And Meltdown Vulnerabilities]() | None | None | -| [Splunk Vulnerabilities](splunk_vulnerabilities) | [Network Denial of Service](/tags/#network-denial-of-service) | [Impact](/tags/#impact) | +| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Network Denial of Service](/tags/#network-denial-of-service), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | @@ -137,11 +139,12 @@ sidebar: | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | | [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | +| [Windows Drivers](windows_drivers) | [Rootkit](/tags/#rootkit), [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows Log Manipulation](windows_log_manipulation) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | | [Windows Persistence Techniques](windows_persistence_techniques) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Print Processors](/tags/#print-processors) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows Privilege Escalation](windows_privilege_escalation) | [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Windows Registry Abuse](windows_registry_abuse) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Modify Registry](/tags/#modify-registry), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Defacement](/tags/#defacement), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Data Destruction](/tags/#data-destruction), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Windows Registry Abuse](windows_registry_abuse) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Modify Registry](/tags/#modify-registry), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Defacement](/tags/#defacement), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Data Destruction](/tags/#data-destruction), [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Scheduled Task](/tags/#scheduled-task), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows Service Abuse](windows_service_abuse) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [XMRig](xmrig) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [Account Access Removal](/tags/#account-access-removal), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Service Stop](/tags/#service-stop), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | \ No newline at end of file diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index a2e82ada6f..20abefa5c9 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -106,8 +106,8 @@ The search is used to detect systems that are still vulnerable to the Spectre an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 6a1e9ba7d6..0917a3d674 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -104,8 +104,8 @@ The search queries the authentication logs for assets that are categorized as ro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index b62622a8d1..5f3ace6721 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index 0e4e2f3e76..7be962bec3 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index 619c2c2f17..e5c9ae0f7f 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -106,8 +106,8 @@ This search looks for Windows endpoints that have not generated an event indicat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index 6a544cc4dd..72915c0dd2 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -103,8 +103,8 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 28d0d2df60..4598b7b4fb 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -104,8 +104,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 984d86f228..c015834cab 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -109,8 +109,8 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 6aff52ae89..ad9eb36d8d 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,9 +95,9 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 27a70790cb..162aec362e 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -100,9 +100,9 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) Note that **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index 3c1186b06c..d16ce4afab 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -100,8 +100,8 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 55455e2a93..10efb31fcf 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -105,8 +105,8 @@ This search looks for emails claiming to be sent from a domain similar to one th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md index e6310902ca..9ab3027499 100644 --- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md +++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md @@ -110,8 +110,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md index 9739a63334..f94d3d2d96 100644 --- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md +++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md @@ -106,8 +106,8 @@ This search looks for EC2 instances being created with previously unseen AMIs. #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md index 316f2aeec1..f1af016a55 100644 --- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md +++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md @@ -117,8 +117,8 @@ This search detects new API calls that have either never been seen before or tha #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index 9615d0a10f..d095fbfb1e 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md index 545f923c77..a0c5914d7d 100644 --- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md +++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md @@ -101,8 +101,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 53065f388f..4d59c747a4 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -110,8 +110,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 36a268849e..fb2f3b310d 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 403fb22f13..f7858e136a 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index d74cbb489e..4bde8d2248 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -104,8 +104,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index ca2ece7f32..8e94f85b40 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -110,9 +110,9 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index 20d63ca05c..4edf3cf3c7 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -113,8 +113,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 2d8d893263..d60dff7d38 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 5b20abccc9..56efa8a693 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -101,8 +101,8 @@ The search looks for file writes with extensions consistent with a SamSam ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index 9e2ddccfb1..2a52f177ee 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -107,8 +107,8 @@ The search looks for a file named "test.txt" written to the windows system direc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index 98c8b113a5..113a9aa642 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index 30e04bdf55..327f63ad93 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -107,8 +107,8 @@ The search looks for command-line arguments used to hide a file or directory usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 24c82572b1..26bd210d99 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -108,8 +108,8 @@ This search looks for suspicious processes on all systems labeled as web servers #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index 4edf4d3dd0..d16049b585 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -99,9 +99,9 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 1127b2ef17..8a79ce87bb 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -106,8 +106,8 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 1b2a78d77c..9b6c71e976 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -102,9 +102,9 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: -* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index c54433e48d..2ddfc74d8d 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index b0ba58deb9..69d4ec50a4 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 19c8bc230a..fc550147a8 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index 5946b6f4b2..8aa14d73c6 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index 38606d00cd..19cc20b9a4 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index d2e9057518..5470d7ae6e 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -112,8 +112,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 00906a59b0..554642a12e 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -123,8 +123,8 @@ This search allows you to identify DNS requests that are unusually large for the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index a964f7ba27..443884aedb 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md index 3d6d3bd303..43dc1ecf84 100644 --- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md @@ -108,8 +108,8 @@ This search looks for EC2 instances being created with previously unseen instanc #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index ac4afeca5e..0cc68086ed 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -102,8 +102,8 @@ This search looks for processes referencing the plist files that determine which #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 21a716fc3f..b9fbb8dd03 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -113,9 +113,9 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,6 +145,7 @@ None identified. * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) * [HAFNIUM Group](/stories/hafnium_group) * [Living Off The Land](/stories/living_off_the_land) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index 4293d2201c..015266cda9 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -98,8 +98,8 @@ This search monitors for remote modifications to registry keys. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 7bf76c3922..3b9cb91aa7 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -116,8 +116,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index e3eb455fb4..f401a7c0e8 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -113,9 +113,9 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: -* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) Note that **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 81d60f00d1..61227044bb 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -110,8 +110,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index f92431359f..4e454d0e2d 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -110,8 +110,8 @@ This search looks for scripts launched via WMI. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 661bd66a7c..e8ad51aaa3 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) Note that **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index a6346aea8f..801ecb2e37 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) Note that **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index 62c22beed4..4203ca40fa 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -102,8 +102,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) Note that **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 53051afdcb..902db37bb6 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index 260f3db8a5..c6f67e1323 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -123,8 +123,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 71bf389485..c53a4ec86a 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -114,8 +114,8 @@ This search detects accounts that were created and deleted in a short time perio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 5fe6fe26ad..b8c7760064 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,9 +115,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 216b152650..2eb14ff048 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -117,8 +117,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index 052f8233cd..788f5d7e61 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 8c67489011..7ce611ae4c 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -118,9 +118,9 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md index 6060e39577..8577bf1e0b 100644 --- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md +++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md @@ -118,8 +118,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index 0292271886..0046ebb8b2 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) Note that **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index e229c3e9a5..b18dc909c4 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -119,8 +119,8 @@ This search detects user accounts that have been locked out a relatively high nu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index 3d030849c3..6e06cf8484 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -115,8 +115,8 @@ This search is used to detect attempts to use DNS tunneling, by calculating the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md index 9a11a10b9e..273ce7537d 100644 --- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index ac45919672..912387e432 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -114,8 +114,8 @@ This search looks for outbound SMB connections made by hosts within your network #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 561e955bb4..8dc1096616 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -126,8 +126,8 @@ This search looks for execution of process `outlook.exe` where the process is wr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index 3630f904b1..f8f3d5e76a 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -112,8 +112,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index 421de97085..0b615e08f2 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -109,9 +109,9 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) Note that **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 91039392d5..f57c3c016a 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -110,8 +110,8 @@ This search looks for specific command-line arguments that may indicate the exec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index 984772696c..2a3183ad30 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md index c91ae03d9a..7e2df37260 100644 --- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md @@ -117,8 +117,8 @@ This search looks for EC2 instances being created by users who have not created #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 58712a4b85..c20cd71e8f 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -111,8 +111,8 @@ The search looks at the change-analysis data model and detects email files creat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index 9c19c3179a..c73e0ff14c 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -126,8 +126,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 2710475c14..b37c976fbc 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index b9dbf9f82e..74ca087556 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -111,8 +111,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index a88f157eb2..6bc1c31bc9 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 0d4ae796db..326187b09a 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -119,8 +119,8 @@ This search detects Okta login failures due to bad credentials for multiple user #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) Note that **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index ed1e9a3086..cc03763381 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -117,8 +117,8 @@ Detect failed Okta SSO events #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) Note that **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index e628063e6e..0cd59c7473 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -118,8 +118,8 @@ This search detects logins from the same user from different cities in a 24 hour #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) Note that **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index be306598f8..18c0aeecdb 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -114,8 +114,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 943d7685ad..e62f64d154 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -113,8 +113,8 @@ This search looks for network traffic defined by port and transport layer protoc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 0f2d652b6c..4c55abfac6 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -115,8 +115,8 @@ This search looks for network traffic on common ports where a higher layer proto #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 0c09e597ed..7309b95c4d 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -117,8 +117,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index 4133408875..063f6913a4 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -119,8 +119,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index 890286ee36..0adc1b3fc5 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -109,8 +109,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index 7412408a3e..e48b2a88bd 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -113,8 +113,8 @@ This search looks for changes to registry values that control Windows file assoc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index c1952a3520..d74b9d5a7b 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -107,8 +107,8 @@ This detection looks for emails that are suspicious because of their sender, dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 3019769d2e..fa4f49af87 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -117,9 +117,9 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index 858350cf0b..9c8f73d6e0 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -114,8 +114,8 @@ This search looks for reg.exe being launched from a command prompt not started b #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 5a1aa00ddb..47ebc94eed 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 0f6d463c77..8001dd1e4e 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -114,8 +114,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 5ce41fd407..25adedf5d9 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index fb4f7c67fb..67c9dc6275 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -112,8 +112,8 @@ Attackers often disable security tools to avoid detection. This search looks for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 8b976ae96a..139a7c944f 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) +* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) Note that **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index 2f4d5110f6..64b17deb2a 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -122,8 +122,8 @@ This search looks for cloud instances being modified by users who have not previ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md index 8e6d952edd..ff803f6754 100644 --- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md +++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md @@ -98,8 +98,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index 4ed9be8ec4..6a2102f69b 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -113,9 +113,9 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index 369753c2c9..2eabd5a4ff 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 9485f22559..37506021e4 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -117,8 +117,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index e505cb5098..9523f43cb4 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -106,8 +106,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index 386792548e..ffa3d2b441 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -106,8 +106,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index b46bbbd8ab..36c61ed7ff 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -106,8 +106,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 5f32f9e04c..b65451dee5 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -109,9 +109,9 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index d9863180de..97d3c5f84d 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -108,9 +108,9 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: -* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) Note that **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index 3fa45a8248..fa8862e06e 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -109,8 +109,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index fa73379f76..e75d7d4931 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -119,8 +119,8 @@ This search identifies endpoints that have caused a relatively high number of ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index b0998a4e68..55c8ff2d4e 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -113,9 +113,9 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 31977e6ae7..0e0621b0ae 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) Note that **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index 28e1fd13a4..7c6c0f01f0 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -114,8 +114,8 @@ This search looks for processes launched from files that have double extensions #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index e8db8805fa..87ee25c640 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -109,8 +109,8 @@ This search looks for processes launched from files with at least five spaces in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index 4605551454..18a23c62e3 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -107,8 +107,8 @@ This search looks for processes launching netsh.exe to execute various commands #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 196654164c..6bd8aaf93b 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -113,8 +113,8 @@ This search detects the process execution and arguments required to silently cre #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index 5fc1cbecb2..bc69dca97c 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -121,8 +121,8 @@ The search looks for reg.exe modifying registry keys that define Windows service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index b25e73bcc3..28e8dc1375 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -115,8 +115,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index d74331d111..ad652b1afd 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -112,8 +112,8 @@ This search looks for shim database files being written to default directories. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index fc85a44d04..b5ea8e9863 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -115,8 +115,8 @@ This search looks for process names that consist only of a single letter. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 197647ea9c..42d7edeef6 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: -* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) Note that **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index eee05e67d8..fb85f45b4f 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -105,8 +105,8 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 0aa0abaa98..58d9b858c1 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 08a124a8c2..447549f4e1 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -106,8 +106,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 32c4fc9331..0e2c303a9a 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -107,8 +107,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index aa8a2bf23f..ea27ea6f41 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -101,8 +101,8 @@ This search provides detection of users with KMS keys performing encryption spec #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index c3854cdbd8..a20843401c 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -114,8 +114,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 6a01a575a2..74562f94e1 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -111,8 +111,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 45c2dd9353..8ee90b72b9 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -107,9 +107,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 81d1ded57c..0e3806ea76 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index d970843447..b9fcb706d2 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -112,8 +112,8 @@ The following analytic identifies child processes spawning from "mshta.exe". Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index b38d2cb44a..2a316b7906 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -112,9 +112,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index f0a42112b4..8f27aa6c43 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md index 590708d123..7fad9174ed 100644 --- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -112,8 +112,8 @@ This search looks for PowerShell processes started with a base64 encoded command #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index aa7ca6e533..53eb941af2 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -112,9 +112,9 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index b97bcb2f82..a0e541b2ca 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index 1efb104c01..cc81f64a4c 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -106,8 +106,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index c659f13c37..a33efb5185 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -103,8 +103,8 @@ This search provides specific SAML access from specific Service Provider, user a #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index a8e75ff12f..12b3589f24 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -103,8 +103,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index 7f98814d02..36145ee1f4 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -93,8 +93,8 @@ This search looks for arguments to certutil.exe indicating the manipulation or e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index ed317857d0..1159471776 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -113,9 +113,9 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index f531e003be..c6f240a0d1 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -114,8 +114,8 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index a693bd7784..d383a80f4d 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -112,9 +112,9 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index b199cbcbe9..98eeed668c 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index a80aae3e91..8390feaf8e 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index aaf6a86329..c69a80a8cb 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 1a4a872fe2..59735fc482 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 7f890de882..946ab0e4ed 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 3ce4102d72..3780f815a6 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index feabbedba2..7389ff250a 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index 7d3064f5f9..0ed0bf6012 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -112,8 +112,8 @@ The following analytic identifies regasm.exe spawning a process. This particular #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 78499b44aa..b21be132e1 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -112,8 +112,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md index f2b5767364..5fddfe8ebe 100644 --- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md @@ -121,8 +121,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md index 71a536bbeb..0e70fa2818 100644 --- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md +++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md @@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index b5270fdc18..51d6763076 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -104,8 +104,8 @@ The following analytic identifies the use of a curl contacting suspicious remote #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 6207c587f1..3a1aa8c4af 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -118,8 +118,8 @@ Upon triage, capture the property list file being written to disk and review for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 38d308f434..b5069a51cb 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -104,8 +104,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index eef9219584..337c7b7e45 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -118,8 +118,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index 06420d1df1..ad6d500487 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -107,8 +107,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index 68a2cb82b1..58ebb99a88 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -111,8 +111,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index e3c4503e8c..64a41e2444 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -117,8 +117,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index 047d95b9d0..0528d9497c 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -107,8 +107,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index ec559314dc..5305e0d427 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -112,8 +112,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 85370c1aea..58162b0639 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 78762c6afe..e5f91cd411 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index d459b46915..13b8c77cf1 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index 288f0307a8..188fc9f4a8 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -102,8 +102,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index e9a10ed2b3..895cad31c1 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index 5a565e980e..15fab392c7 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index 8001922462..dc7696c984 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -102,8 +102,8 @@ The following analytics are designed to identifies some CLOP ransomware variant #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 8b7470b10f..a0c77a5d05 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index 13a8277347..535b08bf8c 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -102,9 +102,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 64f85e737c..e19498b493 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index 255d9f47a4..4c3a3cbd67 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -110,8 +110,8 @@ The following query uses IAM events to track the success of a group being delete #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 6f41ce89c2..50b3f4da68 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -107,9 +107,9 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) Note that **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index a4698c305f..206d347377 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -107,8 +107,8 @@ In addition to trust discovery, review parallel processes for additional behavio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index 45408a589f..15947dcf4d 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -106,8 +106,8 @@ The following detection identifies any malformed policy document exceptions with #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index e3d7e22345..1575dfd36a 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -100,8 +100,8 @@ The following detection identifes when a policy is deleted on AWS. This does not #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 00e4683600..b793b9283d 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -100,8 +100,8 @@ This detection identifies failure attempts to delete groups. We want to identify #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index ff16833ce2..d2943a0edb 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index 4c59958230..a25c3b8fc1 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -106,7 +106,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v ``` `wineventlog_security` EventCode=4698 | xmlkv Message -| search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") +| search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,6 +140,7 @@ False positives are possible if legitimate applications are allowed to register * [Ryuk Ransomware](/stories/ryuk_ransomware) * [IcedID](/stories/icedid) * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 8769d24df3..18fceec683 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index d2f58981f2..7ad41cf22b 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 2e40959111..3d06f1ae2c 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 9f2736cd5a..7435c278a9 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index 32a544f3a3..f1f4f8875e 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index f2c20b14e6..d6de864826 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -107,8 +107,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 6c3b38bfdd..f9539f7ce3 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -107,9 +107,9 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index e1df7ecf2f..2df2c08b22 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index 712dd21be0..4b21420204 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index 086a8d5463..ed23e6ccca 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -102,8 +102,8 @@ this search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 81a76ff8c8..c43e81b053 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 21a66d2af0..ecd709a0e6 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 4b63079399..ef713b2e06 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index 41f98dbe17..73bc6c0ec9 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index ba6c575f79..cd138f7ea3 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 91587e7359..94528e236a 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index 1c79405b19..ed31a7793f 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index d753d5416f..1da816b5f4 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) Note that **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 026dfb4c89..e9cc22551c 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -107,8 +107,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index ce9b807814..8a78a3bf34 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index d0977c1006..b554f66150 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) Note that **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 2939190510..f4e48abf0d 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 0a05d80c76..8022fbfc39 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index 8fb44b7307..f8f6a61372 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 35e84d7380..3533abb60a 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 0eadc14902..1158b6cf9a 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index ea76065a36..1a44f88cfd 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -102,8 +102,8 @@ This analytic identifies a potential adversary that changes the security permiss #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 4639b50b53..7db21c16a7 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index a8ebca20c2..0b79a8782f 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 87cc18a125..63888d2cb9 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -102,9 +102,9 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index c87608b2af..bdb1491c51 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -102,9 +102,9 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index 86c2ef3983..5ed2cfa27c 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -103,8 +103,8 @@ This analytic will identify suspicious series of command-line to disable several #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index db01ae7de5..2510142ab6 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -103,9 +103,9 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index db6f449866..bff59e613c 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -108,8 +108,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 00f48d4a42..79dbc6a308 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -102,8 +102,8 @@ This analytic identifies potential adversaries that modify the security permissi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index dad7f75cb2..a6f0eadd62 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -107,9 +107,9 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index 479de8e89e..7f8d2015e5 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -103,8 +103,8 @@ The following analytic will detect a suspicious process running in a file path w #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -132,6 +132,7 @@ Administrators may allow execution of specific binaries in non-standard paths. F * [Remcos](/stories/remcos) * [WhisperGate](/stories/whispergate) * [Hermetic Wiper](/stories/hermetic_wiper) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 552c212ffa..a854bfb692 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index 31daed681e..bf23163ed6 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -101,8 +101,8 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index a5e5987dd7..ce6ef5b4e5 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -103,9 +103,9 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index 2afccf3098..e7d138d8f2 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -102,8 +102,8 @@ This analytic will identify suspicious executable or scripts (known file extensi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -129,6 +129,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte * [Remcos](/stories/remcos) * [WhisperGate](/stories/whispergate) * [Hermetic Wiper](/stories/hermetic_wiper) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index 419bbf60f9..172b4f0ac3 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -103,8 +103,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index 71a7b0c3b8..4d68f999ad 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -104,8 +104,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -127,6 +127,7 @@ Administrators may use to debug Schedule Task entries. Filter as needed. #### Associated Analytic story * [XMRig](/stories/xmrig) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 5f00a8936a..b0016a85a6 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index 83aa471b84..ad740ff550 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 78d3e13e15..37ae2ee3f5 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 111aed62b4..054ab7177a 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -103,8 +103,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 1ab2733287..b648276bce 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 6295e08729..6c50a0ad1c 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -110,8 +110,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index e4a14eac94..5ede6720a5 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -107,8 +107,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index 1fec708062..a65e888144 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -132,8 +132,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 40aecd78e8..3f19325d68 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -132,8 +132,8 @@ The following analytic identifies SharpHound binary usage by using the original #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index 2f86780e5b..7a763954c0 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -132,8 +132,8 @@ The following analytic identifies the common command-line argument used by Azure #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index 7362e6878b..7037ea35b7 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -132,8 +132,8 @@ The following analytic is similar to SharpHound file modifications, but this ins #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index e2b9944f35..d5b1551e14 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -132,8 +132,8 @@ The following analytic identifies common command-line arguments used by SharpHou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 3c42239755..d6723b7f04 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -102,8 +102,8 @@ This search detects the suspicious commandline argument of revil ransomware to e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index df6790b3d3..a296abe1a9 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index b9ba0e42cc..26fa5f1342 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -102,8 +102,8 @@ This analytic identifies suspicious commandline parameter that are commonly used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index b2016bf0c5..1e9dc12127 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index 8955a7020a..e03accc979 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index cba315f686..170d22adf3 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -107,8 +107,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 5d3073b19d..f0d527ce43 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -107,8 +107,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 65afbb55b4..6f2b1af284 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -107,8 +107,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index bfa5dec6d4..dbc2ab8cb9 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -102,8 +102,8 @@ This search is to detect a modification of file or directory permission using ta #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 5baf9cff8c..5ba60d93de 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index 986c97fc50..fa06692d54 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index 8173d871c1..62f0415a0f 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -115,8 +115,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index b02e4f9638..93f0cb6512 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -107,8 +107,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index f5be2dfb63..cad4230f8c 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index e66f03e701..205add643a 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -107,9 +107,9 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) Note that **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index f2bc9ae796..36ae60980d 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -107,9 +107,9 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) Note that **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 12b22c558f..4750ec2ea0 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index 43af8b2ce6..6671a1b142 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -108,8 +108,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index 39e80769c2..385e312b70 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) Note that **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 68ac8a785d..2eb3ddd701 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) Note that **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index cd7527b79f..bf0426e577 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -114,9 +114,9 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index 3a912ebefc..dbce47b9c7 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index f549313207..e28f396237 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 34e5e5af0f..52f30c1349 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index 8d4265d98a..421a6bb7bf 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -111,8 +111,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index ae96cf1d74..fc6a32f7ff 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index cf52d7e01a..8c1957878b 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index 8d5c2f2a31..8c47f9ca87 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -122,8 +122,8 @@ This search looks for cloud compute instances created by users who have not crea #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index f800e58822..d00adf12c1 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index 364ee513a4..a31e892d5a 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index a3c79a5700..4ae443a594 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -108,8 +108,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 54f2636eb9..ca29ba5912 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -107,10 +107,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) Note that **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 54b0252299..0cc6bbe956 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index c56733a83c..9fbc6d0603 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index dc22f72471..f3edc8694b 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 8a062b9a7c..49192440ea 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -107,9 +107,9 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index c6aeb7557b..c2fe18f32b 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -107,9 +107,9 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index c04c536540..fced024e03 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -102,8 +102,8 @@ This search is to detect execution of chcp.exe application. this utility is used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index f54d937964..838c62d3d8 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -109,9 +109,9 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 537bb14e8d..e3d3f392d6 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index dab7ce0922..1642ea8715 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 74c84eaf29..6edf12b83c 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index 61c950a9cc..cf01b22b99 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -107,9 +107,9 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 8af853fd04..3d6d7f91e5 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 0b9dd66eb8..63c7d6be6e 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index 9a5c199b9e..7d70e2753c 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -107,8 +107,8 @@ This search is to detect a suspicious un-installation of application using msiex #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index dc4782029c..f4d554b272 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -102,8 +102,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 6b4f16d95a..0de21d0535 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index 5f10c86d78..b9dacba00e 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -107,8 +107,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) Note that **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index 1e10de16f5..d609a050de 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -107,8 +107,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index 2ee0d5fd8a..053ef6340c 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index 0778c43a9f..70c74390d1 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 58d17ed3e6..847ba4d0b9 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index 821666721c..65e14a484f 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -112,8 +112,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) Note that **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 3c3527ea25..179470a163 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: -* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) Note that **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index 7707095da2..2e87df2551 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index cbeee79928..8bf711341c 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -115,9 +115,9 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index 17d48e69de..8cb486ef45 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -110,8 +110,8 @@ This search is to detect a gsuite email contains suspicious subject having known #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) Note that **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index a7212972b6..792c4cde1e 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -105,8 +105,8 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index e4386e0f36..8cb069125a 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) Note that **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index af8ce0d318..e4bff95cbe 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index 5122249467..619162a960 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 86a408ba21..371d9b9057 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 7f91afb3f4..987ffab910 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -110,8 +110,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) Note that **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index f023a72113..e60f72e3ca 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index a9cc95cf1b..718cf3c1f8 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -125,6 +125,7 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. #### Associated Analytic story +* [Industroyer2](/stories/industroyer2) * [Active Directory Discovery](/stories/active_directory_discovery) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index ecf17a28be..c45d9dd9fb 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index 4e8250baca..5bd9295153 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index fb049ae102..1ee95e1903 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index e00b0be711..e56cf8622f 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -102,8 +102,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index da6bf17bf2..9a408350ad 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 993d558e2e..8d25b236cb 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index 24227437e7..bbc1f91c9a 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index 3fdbeb4524..9dd84e7f6a 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -111,8 +111,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### Macros The SPL above uses the following Macros: -* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) Note that **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 634ec4039f..4700b5ffc0 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 54e47508fa..ed160f58cb 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index fc74198d78..1f91ecbd22 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index 39bc5e2074..4b3a54b22c 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index d0eec5c74a..15a5c8f89c 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index 56f3a3b277..f4167d61f3 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index 09a49edb71..f10e734570 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 41cd7eaa23..40b9bcec09 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index c726c55842..1e5abf7b0c 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index 88912538b2..7181ea5035 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index c3fe62d009..59a92beff2 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index b58d657a1f..074ac6c176 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index 99b8bb3f10..e2c3fb2e82 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -121,8 +121,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 4901512136..26b2b7d18c 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) Note that **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index 15533bf1f2..f2902e7957 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 7c484cf91b..e29a587403 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 2a711dfc8a..80b87bd7d6 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -108,8 +108,8 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 7d81a15a3e..ace1d3011d 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -105,8 +105,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index 1689c8eea5..2257445617 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index de512ad817..413d248d1b 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -117,8 +117,8 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) Note that **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index fba3ea15c2..08187b3666 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index 8756290679..ded28ae614 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 295fa24353..25c3927186 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) Note that **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index bb9da9f88c..9498c4e6a2 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs. #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) Note that **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 6cfc74bc7e..3d1baf9a67 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index 114ee9caac..c2020345d4 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 15a7466b8c..4eb3d0488b 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -113,8 +113,8 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) Note that **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index eca0a8b31f..88e79f9fd2 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -102,8 +102,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index 40ca2e08c7..f95cb82a9b 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index 2511260eea..9e88e01d9d 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index ac1557f390..af3985fa64 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index af4b7dc446..652c2bbf63 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index 00a3011d8d..70c9b0df61 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index 4718bfffb1..1db32dc7a8 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index b0576cbb0c..5679158b61 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index 383d81124b..a2c924e506 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -110,8 +110,8 @@ Detect system information discovery techniques used by attackers to understand c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index aa46993c4a..3578087dc0 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -112,8 +112,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index 35ab180cfc..89b17543f7 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -112,8 +112,8 @@ This search looks for the creation of local administrator accounts using net.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index e12612ba8e..551671112f 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -112,8 +112,8 @@ The following detection identifies control.exe spawning from an office product. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 01131f25c4..10acc58dff 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -112,9 +112,9 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index 82b16635a2..8dcec90e94 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -112,9 +112,9 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 3e97237b15..4bb0409bac 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -107,9 +107,9 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index 6fe995e38e..e9d852091f 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index 77a2381f84..15e62a9286 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index eb6c64257e..2dcd1588cd 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index 727f59bbaa..137f00e536 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index 6984d6e8e4..e138e64cf9 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index 2eef80d7c4..3b7b2966f0 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -107,8 +107,8 @@ This search is to detect a execution of jscript using cscript process. Commonly #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index d466c29b33..48a0b4de9a 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 25a5d34c04..b9c551bed9 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 4702a3f9c1..2ad7dbf583 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 154f2b9492..00563ff01e 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index 9cb6d6fda2..b2b7f846f6 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index adc653cb31..8197cdb8f8 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -102,9 +102,9 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index d8f27b583b..4bf3e11d30 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -107,8 +107,8 @@ The following analytic identifies a non-standard parent process (not matching CM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index c2fb13e6aa..6195a6221a 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index 37f4d94617..c227813936 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic will identify the use of localgroup discovery usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 9dbeea78da..9a1ea5802b 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 90fedae751..899fc48279 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -109,8 +109,8 @@ During triage, review parallel processes and identify any further suspicious beh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index a78f6fae12..cfede24e2d 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -102,8 +102,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index 7faccae078..c19b4e40ec 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index bc541ca2ed..0e2aea7d72 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index 1f3589d4ee..d2d47cd2e7 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -108,9 +108,9 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index cc1e2c0bee..985920736d 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -116,9 +116,9 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index bc6256789a..d129d794bd 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,10 +113,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,6 +145,7 @@ None identified. * [Credential Dumping](/stories/credential_dumping) * [DarkSide Ransomware](/stories/darkside_ransomware) * [Windows Registry Abuse](/stories/windows_registry_abuse) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index ff6bbe786b..9d4c04f468 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -103,9 +103,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index ff54a4e63e..6b18c8083f 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -108,9 +108,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 1fd8dbc9ef..db65257052 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,10 +112,10 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 5f43359cf3..eae86f8ae3 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index b5dc37517c..5b8f250241 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 1a3d34c5aa..1238faa275 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index fa778498db..5fa2523bbd 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 849dfafdc8..74e79b0469 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -112,9 +112,9 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index b49acd11d3..43c9c44af6 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -112,9 +112,9 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 47536feef9..7135d6a736 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -112,9 +112,9 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index dd228c651e..98f422f76e 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -107,8 +107,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index 3191c9bf44..08d288f6b1 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -101,8 +101,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index e1002a78ee..b7382fef74 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -107,8 +107,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 35fd14421e..5120ca5611 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index b5bc1c8bce..24a77cb66a 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index ff15a01c6a..1c9cea77b2 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 1cd32fc04c..c376bc2512 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index eb96b3a1ea..a6fa63324a 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -112,9 +112,9 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) Note that **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index 0b897e5aa3..2101d93e7b 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -107,8 +107,8 @@ This search is to detect potential malicious office document executing lolbin ch #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index 2a5228ae5e..c2bdeb5212 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -102,8 +102,8 @@ This search is to detect file creation in remcos folder in appdata which is the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index e0662a48de..d575013b93 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -109,8 +109,8 @@ This analytic is developed to detect suspicious registry modification to change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index 73a40e321f..1031804d60 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -109,8 +109,8 @@ This search is to detect a suspicious modification of registry entry to persist #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index 3a34469a77..95863ff7c3 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -109,8 +109,8 @@ This analytic is developed to detect possible event trigger execution through sc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 6344fd89c4..eecad70e0d 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious modification or new registry entry regar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index aeca9d6439..df46277db6 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,9 +107,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) Note that **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index f867ce1306..7c3c0c36bf 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 5eb659b6f3..20d2c25a79 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -107,9 +107,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index b3561698f6..60cc951119 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -109,9 +109,9 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index 917bdaa5a9..5d213c80d5 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -112,8 +112,8 @@ The following analytic identifies a process modifying the registry with a known #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index 62958751ae..a466d1f6bb 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -112,8 +112,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index 08f8dd4272..4850cea3fa 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -102,9 +102,9 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index 5bd5600992..1601238844 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -107,9 +107,9 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index 9882f5a421..ba25a484ff 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -103,8 +103,8 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 5b800fc09a..feeb557e2b 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -112,9 +112,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: -* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) Note that **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index 6d65ab661d..ba70937134 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -121,8 +121,8 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index 4d58347ee1..caf2f1a03f 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -118,8 +118,8 @@ The wevtutil.exe application is the windows event log utility. This searches for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 3de56a7ff9..3a534bdd2f 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -109,9 +109,9 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index 07a2274a25..2943b0a04b 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious commandline to disable existing schedule #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 3a8e2baa9d..72411603de 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -104,9 +104,9 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index 5af6decbb8..db42484d58 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -104,8 +104,8 @@ The following hunting analytic assists with identifying suspicious tasks that ha #### Macros The SPL above uses the following Macros: -* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) Note that **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -127,6 +127,7 @@ False positives will be present. Filter based on ActionName paths or specify key #### Associated Analytic story * [IcedID](/stories/icedid) * [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index c8b089a7b6..19d164fe8a 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index 7e407788a4..2d33a7e038 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -107,8 +107,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index 0eb050e01e..66f2db97da 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -126,8 +126,8 @@ This search looks for execution of commonly used attacker tools on an endpoint. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index 43322feb63..8a54d2656a 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -106,9 +106,9 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index 34ccc24dd6..2ce2d86564 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index dc2409a1e6..d50220cb14 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index ecc8f02835..7c2b9a8602 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index e62a610236..f13678a0ac 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -111,8 +111,8 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 3125e7e06e..1d9253db6d 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -111,8 +111,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md index a28e02e2b6..1cfa95eeef 100644 --- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md @@ -115,8 +115,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 45e5ccf511..c207aec5b7 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -102,9 +102,9 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md index 14aa94136a..601af0aab9 100644 --- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md @@ -102,8 +102,8 @@ The following detection identifies excessive AccessDenied events within an hour #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 85dbb9e458..c2f25f35dc 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -107,9 +107,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) Note that **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index 2422d91026..4b5f89536f 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -107,8 +107,8 @@ This analytic detects a potential suspicious modification of firewall rule allow #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index a929569f28..c6afd3bf3b 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -107,9 +107,9 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: -* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) Note that **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 6cb031f913..c463f21025 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -110,9 +110,9 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index a208c7fc1d..446258a518 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -109,9 +109,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md index 4d11b99aa7..4dcc0262e3 100644 --- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md +++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md @@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index e468ce76ab..c885bca329 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,9 +111,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index c23a955228..b4cbf4d03a 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,9 +110,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index ed2ee33339..83e3571dd1 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index 93be6d25d3..d8ae1a2601 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index e9d5087279..749164711c 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -102,8 +102,8 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index 06f1fecad3..441455f218 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index 14b40bcb17..a9d65d562c 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -107,8 +107,8 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 784a9a7c38..22a63d1076 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -105,8 +105,8 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,6 +133,7 @@ System Administrators may use looks like PsExec for troubleshooting or administr * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) * [Trickbot](/stories/trickbot) * [Hermetic Wiper](/stories/hermetic_wiper) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index c80c3e0ed1..5dd955aa03 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 5000afcb22..de9d806cb6 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -102,9 +102,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index 8df00bc93c..cb2f6fef65 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -107,8 +107,8 @@ This analytic will detect if a suspicious process contains a commandline paramet #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index c7358fc973..9cfdc8ebea 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -109,8 +109,8 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index 729cd94caf..5bd13df00c 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -111,8 +111,8 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index dc60511f07..3b338d2744 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 022efd6778..b9d4f933a3 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 5ce0d5479b..7ffe682eb2 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -102,8 +102,8 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index f649bc3fd2..276d318044 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -107,8 +107,8 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index f4da0ca5b2..b017b11469 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -107,8 +107,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index d793ad1130..936a9f865e 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -107,8 +107,8 @@ This analytic will identify a suspicious process command-line related to Windows #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index 396257541b..be98c1a77d 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -102,9 +102,9 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index b2dfab2f23..f6a868912b 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -135,8 +135,8 @@ The following analytic assists with identifying a PowerShell process spawned as #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index 1c5a060ed3..2036a963e1 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -107,8 +107,8 @@ The search logic specifically looks for high number of distinct commands run in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index 1f4c67fdd1..f299a1bfef 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -102,8 +102,8 @@ The following analytic identifies the Raccine Rules Updater scheduled task being #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index 361c269435..86ccb7816e 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index 04a4b6a881..9d5565668b 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -108,8 +108,8 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 698580d00f..d1767dc18e 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -108,8 +108,8 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 03f4d9a3d6..30b6f0bc30 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -107,9 +107,9 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) Note that **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 9ce50096f2..f7896912d1 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -124,8 +124,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index bda7197ef7..898543d1d4 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -111,8 +111,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 251e71c08f..650a7cb569 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -109,9 +109,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) Note that **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index 1e7fe36812..3ad2b9f0a3 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation in known cron table #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index b22edfc587..1988954c6e 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md index f1547af2d4..15399f7704 100644 --- a/docs/_posts/2021-12-17-linux_at_application_execution.md +++ b/docs/_posts/2021-12-17-linux_at_application_execution.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious process creation of At applicatio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index 79cf2eae8b..5dcf88553e 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious cronjobs modification using cront #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md index 8cffcecc11..302ab92b97 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md @@ -117,8 +117,8 @@ This analytic looks for suspicious commandline that may use to append user entry #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index f4aeecec58..473119e53b 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -117,8 +117,8 @@ This analytic looks for possible suspicious commandline that may use to append a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index 1cb36ac983..c5a8a034a7 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -117,8 +117,8 @@ This analytic looks for possible modification of cronjobs file using editor. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index 4315a875f7..ddc781bd15 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation on init system directories for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index 18c79cd026..a1e453bfe1 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index 5b38061a48..2d585b9989 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -115,8 +115,8 @@ This analytic looks for suspicious command-lines that can be possibly used to mo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index 217a4b6445..c8d4e2ed1e 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -117,8 +117,8 @@ This analytic looks for suspicious file creation in systemd timer directory in l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index 703755e490..29b47b0992 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -117,8 +117,8 @@ This analytic looks for restarted or re-enable services in linux platform. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index ba21128630..d7dac183bd 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -117,8 +117,8 @@ This analytic looks for created or enable services in linux platform. This techn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index 9bb2e6da55..215aaa0b06 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -113,8 +113,8 @@ This analytic looks for commands to create user accounts on the linux platform. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index bffa9d94fd..787bf9cf07 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -113,8 +113,8 @@ This analytic looks for a commandline that change the file owner to root using c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index 2e35062cc2..1435ec4b25 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -115,8 +115,8 @@ This analytic is to look for suspicious command lines that may add entry to /etc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index cd955f229f..0a1f0db1f2 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -115,8 +115,8 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index 032370489d..68d970d4fc 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -115,8 +115,8 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index 635333b6c8..d4b1ebd892 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -115,8 +115,8 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index e7eec37626..e03f211383 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in kernel/driver directory in l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index ffe968338d..93b650fe0a 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -115,8 +115,8 @@ This analytic looks for inserting of linux kernel module using insmod utility fu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index 9a00b17d52..2c8bf702b9 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -115,8 +115,8 @@ This analytic looks for possible installing a linux kernel module using modprobe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index ce8b6b607f..b2ab9b1edc 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -117,8 +117,8 @@ This analytic is to detect a suspicious command that may hijack a library functi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index 5145ad6a08..630260d649 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -115,8 +115,8 @@ This analytic is to look for possible elevation control access using a common kn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index 3fc911ce45..5ecd7ddeb9 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -115,8 +115,8 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index 990ea25592..a4091d5bd5 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -115,8 +115,8 @@ This analytic is to detect the execution of sudo or su command in linux operatin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index e199d2fb38..fed38517b7 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -115,8 +115,8 @@ This analytic is to detect the creation of doas.conf file in linux host platform #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index 4bab1c3341..1599d008a8 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -115,8 +115,8 @@ This analytic is to detect the doas tool execution in linux host platform. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index a68baf76b1..8abacad923 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -113,8 +113,8 @@ This analytic is to detect a possible attempt to dump or access the content of / #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index 37fff063bf..d32def4018 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -115,8 +115,8 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index d7c41c5d61..646b74e3e7 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -113,8 +113,8 @@ This analytic is to look for suspicious process command-line that might be acces #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index 064027d5cc..44b67839f1 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -113,8 +113,8 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index f97f4b9896..7bd661d040 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index cd569b7713..de5dd6c1d4 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index 45575c540c..1aaff1ac13 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index 70a9136394..13e4d8f295 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -108,9 +108,9 @@ The following analytic uses a pretrained machine learning text classifier to det #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 3975681f7b..61b7d865ab 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) Note that **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index 9900b5ed28..b0d8b9a34a 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -123,8 +123,8 @@ This analytic looks for the presence of suspicious commandline parameters typica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -152,6 +152,7 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) * [WhisperGate](/stories/whispergate) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index e87bd58b2b..6d076a994e 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index 20ea3aa0e0..625116b089 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md index c102f70073..790b96d787 100644 --- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md @@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 20288a14c6..c4fbc9c057 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -118,9 +118,9 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: -* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) Note that **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 75b9538dfa..d8f29439d6 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,9 +117,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 19efd5ad59..8c544b007e 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index d96b03ca2d..0c8dcdca5f 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -115,9 +115,9 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index 5078976b82..2e355530e0 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -102,8 +102,8 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index 25f5abdba3..6a018a961f 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -103,9 +103,9 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) Note that **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index 2f00e615bb..bbb3d2e272 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -121,8 +121,8 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index f3f96dfe7f..4ec0f102de 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index 7c7fcdc9c2..98c5d90bf3 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -108,8 +108,8 @@ The following analytic identifies `pkexec` spawning with no command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index aa1a868bc5..9c374923f6 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -109,8 +109,8 @@ The following analytic looks for the use of Mimikatz command line parameters lev #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index a7f41d2ddc..01896d56f2 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -124,8 +124,8 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index d1cb322156..7b5f317c98 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index 89e246923f..a1a15a29b4 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index db38882aa7..b3a2bd7c5d 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 59dc098559..55b00b0056 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -103,9 +103,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) Note that **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index a57a7d5c88..35d63e9024 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -111,9 +111,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: -* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) Note that **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 10b5ccf990..e0bbec1969 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -113,9 +113,9 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index d2ad6023e7..75b0670ea5 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -110,8 +110,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-11-linux_system_network_discovery.md b/docs/_posts/2022-02-11-linux_system_network_discovery.md index 2dacb89f78..97accff133 100644 --- a/docs/_posts/2022-02-11-linux_system_network_discovery.md +++ b/docs/_posts/2022-02-11-linux_system_network_discovery.md @@ -130,6 +130,7 @@ Administrator or network operator can execute this command. Please update the fi #### Associated Analytic story * [Network Discovery](/stories/network_discovery) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index 2c0e0894f3..86a1977809 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -108,8 +108,8 @@ This analytic is to look for dd command to overwrite file. This technique was ab #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -132,6 +132,7 @@ Administrator or network operator can execute this command. Please update the fi #### Associated Analytic story * [Data Destruction](/stories/data_destruction) +* [Industroyer2](/stories/industroyer2) diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 71d2b5ea18..538857c064 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -106,9 +106,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: -* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) Note that **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index c13f758e80..9bec2a26f5 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -114,8 +114,8 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index f5db7edcb5..27f66158ab 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 697c39bd16..33ed55e6c3 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 24486be582..5fcf4a6cbc 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index 2272a169c5..5a1d767dda 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -109,8 +109,8 @@ This search is to detect modification of registry to bypass UAC windows feature. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index 3eeb6d0ab4..2fa3827afe 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index 640a455271..a1454b06df 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index ad2c3f2a3f..8e78e8488b 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -113,8 +113,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index 9a48eed0ef..f7b8fe52f7 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -115,8 +115,8 @@ The following analytic identifies the creation or deletion of a scheduled task u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 49b61a5b71..a6e6bf3833 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -108,9 +108,9 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 2b50b29d1e..f9f0572550 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index 0b6820e344..55982e231d 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -109,8 +109,8 @@ This analytic is to look for process commandline that contains named pipe. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index f03705abc2..4920f10377 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -114,8 +114,8 @@ This analytic is to look for suspicious file creation in the critical folder lik #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 09fa8ebf84..819ed31cf9 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md index a260113d4b..b6fd1bc350 100644 --- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -103,8 +103,8 @@ This analytic will identify suspicious series of process executions. We have ob #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md index 6dd7347cd5..aadceda6d0 100644 --- a/docs/_posts/2022-03-03-aws_createaccesskey.md +++ b/docs/_posts/2022-03-03-aws_createaccesskey.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md index ecbe2fa65c..0a3fd5cbb0 100644 --- a/docs/_posts/2022-03-03-aws_updateloginprofile.md +++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index c5dc7329e1..1512d4c20c 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -115,8 +115,8 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p #### Macros The SPL above uses the following Macros: -* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) Note that **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index a396f0e7ba..4fcc581205 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -122,9 +122,9 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md index d3629e977a..599c0939bb 100644 --- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md +++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md @@ -108,8 +108,8 @@ The following analytic identifies a process performing an outbound connection on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index 6f06eb6c55..8891732a67 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index 5c850a1da6..2bfea68b87 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) Note that **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md index 6ae68ab0ac..772ed5f046 100644 --- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md index b2d06297ca..dac22000fe 100644 --- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md index 84d447d319..b76329ebcc 100644 --- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md @@ -105,8 +105,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) Note that **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index 98a8c001df..6e324d3b9a 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -118,9 +118,9 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md index 2f49f3fc5a..f31630945d 100644 --- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index b5079114dd..6dfe5e635f 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index ff9cc07e7f..097fc09892 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 3707383ea3..9f48225e77 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -118,9 +118,9 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md index 396e063181..986cc33ef5 100644 --- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -104,8 +104,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index ddac36a39b..921df93a7c 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,9 +115,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 6bbba331d6..e850747500 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,9 +116,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md index 91520b029e..3b06db008c 100644 --- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md @@ -102,8 +102,8 @@ This analytic identifies suspicious modification of ACL permission to a files or #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md index 737a8e6d4d..e3b59885d0 100644 --- a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md +++ b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md @@ -102,7 +102,7 @@ On March 24th, 2022, Splunk published a security advisory for a possible Denial #### Search ``` -`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread +`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter` ``` @@ -155,4 +155,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_dos_via_malformed_s2s_request.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_dos_via_malformed_s2s_request.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 9dfd2c5d9e..1a620cbbac 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) Note that **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-29-macos_plutil.md b/docs/_posts/2022-03-29-macos_plutil.md index e259582863..8c8939d95c 100644 --- a/docs/_posts/2022-03-29-macos_plutil.md +++ b/docs/_posts/2022-03-29-macos_plutil.md @@ -110,8 +110,8 @@ Detect usage of plutil to modify plist files. Adversaries can modiy plist files #### Macros The SPL above uses the following Macros: -* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) Note that **macos_plutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md new file mode 100644 index 0000000000..17895217c5 --- /dev/null +++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md @@ -0,0 +1,174 @@ +--- +title: "Windows ISO LNK File Creation" +excerpt: "Spearphishing Attachment +, Phishing +, Malicious Link +, User Execution +" +categories: + - Endpoint +last_modified_at: 2022-03-29 +toc: true +toc_label: "" +tags: + - Spearphishing Attachment + - Phishing + - Malicious Link + - User Execution + - Initial Access + - Initial Access + - Execution + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-03-29 +- **Author**: Michael Haag, Splunk +- **ID**: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + +| [T1204.001](https://attack.mitre.org/techniques/T1204/001/) | Malicious Link | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Delivery + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_iso_lnk_file_creation_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +Note that **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* Filesystem.file_create_time +* Filesystem.process_id +* Filesystem.file_name +* Filesystem.file_path +* Filesystem.dest + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. + +#### Associated Analytic story +* [Spearphishing Attachments](/stories/spearphishing_attachments) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 80 | 50 | An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. | + + +#### Reference + +* [https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/](https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/) +* [https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1](https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_iso_lnk_file_creation.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md new file mode 100644 index 0000000000..1cde0cf439 --- /dev/null +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -0,0 +1,162 @@ +--- +title: "Windows Drivers Loaded by Signature" +excerpt: "Rootkit +" +categories: + - Endpoint +last_modified_at: 2022-03-30 +toc: true +toc_label: "" +tags: + - Rootkit + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic assists with viewing all drivers being loaded by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to assist with identifying suspicious drivers. Use this analytic to look at prevalence of driver (count), path of driver, signature status and hash. Review these fields with scrutiny until the ability to prove the driver is legitimate and has a purpose in the environment. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-30 +- **Author**: Michael Haag, Splunk +- **ID**: d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1014](https://attack.mitre.org/techniques/T1014/) | Rootkit | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode=6 +| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) count by Computer Signed Signature service_signature_verified service_signature_exists Hashes +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_drivers_loaded_by_signature_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) + +Note that **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* ImageLoaded +* Computer +* Signed +* Signature +* service_signature_verified +* service_signature_exists +* Hashes + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. + +#### Known False Positives +This analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat. + +#### Associated Analytic story +* [Windows Drivers](/stories/windows_drivers) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 42.0 | 60 | 70 | A driver has loaded on $Computer$. | + + +#### Reference + +* [https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/](https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/) +* [https://attack.mitre.org/techniques/T1014/](https://attack.mitre.org/techniques/T1014/) +* [https://www.fuzzysecurity.com/tutorials/28.html](https://www.fuzzysecurity.com/tutorials/28.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_drivers_loaded_by_signature.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-31-windows_registry_certificate_added.md b/docs/_posts/2022-03-31-windows_registry_certificate_added.md new file mode 100644 index 0000000000..302080b43d --- /dev/null +++ b/docs/_posts/2022-03-31-windows_registry_certificate_added.md @@ -0,0 +1,171 @@ +--- +title: "Windows Registry Certificate Added" +excerpt: "Install Root Certificate +, Subvert Trust Controls +" +categories: + - Endpoint +last_modified_at: 2022-03-31 +toc: true +toc_label: "" +tags: + - Install Root Certificate + - Subvert Trust Controls + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-31 +- **Author**: Michael Haag, Splunk +- **ID**: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1553.004](https://attack.mitre.org/techniques/T1553/004/) | Install Root Certificate | Defense Evasion | + +| [T1553](https://attack.mitre.org/techniques/T1553/) | Subvert Trust Controls | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data +| `drop_dm_object_name(Registry)` +| join process_guid _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid +| `drop_dm_object_name(Processes)`] +| table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name +| `windows_registry_certificate_added_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that **windows_registry_certificate_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.dest +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint. + +#### Associated Analytic story +* [Windows Drivers](/stories/windows_drivers) +* [Windows Registry Abuse](/stories/windows_registry_abuse) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 42.0 | 60 | 70 | A root certificate was added on $dest$. | + + +#### Reference + +* [https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec](https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec) +* [https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_registry_certificate_added.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md b/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md new file mode 100644 index 0000000000..bdda18f3d5 --- /dev/null +++ b/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md @@ -0,0 +1,170 @@ +--- +title: "Windows Registry Modification for Safe Mode Persistence" +excerpt: "Registry Run Keys / Startup Folder +, Boot or Logon Autostart Execution +" +categories: + - Endpoint +last_modified_at: 2022-03-31 +toc: true +toc_label: "" +tags: + - Registry Run Keys / Startup Folder + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal and Network. adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-31 +- **Author**: Teoderick Contreras, Michael Haag, Splunk +- **ID**: c6149154-c9d8-11eb-9da7-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data +| `drop_dm_object_name(Registry)` +| join process_guid _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid +| `drop_dm_object_name(Processes)`] +| table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name +| `windows_registry_modification_for_safe_mode_persistence_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that **windows_registry_modification_for_safe_mode_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.dest +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.process_guid + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Known False Positives +updated windows application needed in safe boot may used this registry + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) +* [Windows Registry Abuse](/stories/windows_registry_abuse) +* [Windows Drivers](/stories/windows_drivers) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 42.0 | 60 | 70 | Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ | + + +#### Reference + +* [https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365](https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365) +* [https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/](https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md) +* [https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/](https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index 1fcf9c74ae..8e7431bdff 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) Note that **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index 5c68e5cdea..efdc32bf2b 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) Note that **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-java_writing_jsp_file.md b/docs/_posts/2022-04-05-java_writing_jsp_file.md index 4e0d54091f..2f54426936 100644 --- a/docs/_posts/2022-04-05-java_writing_jsp_file.md +++ b/docs/_posts/2022-04-05-java_writing_jsp_file.md @@ -118,8 +118,8 @@ The following analytic identifies the process java writing a .jsp to disk. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md index 3f6dcbd0b2..e268c7919b 100644 --- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md +++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md @@ -19,6 +19,8 @@ tags: - Endpoint --- +### WARNING THIS IS A EXPERIMENTAL object +We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} @@ -113,8 +115,8 @@ This analytic looks for suspicious commandline that redirect the stdout or possi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -137,6 +139,7 @@ unknown #### Associated Analytic story * [Cyclops BLink](/stories/cyclops_blink) +* [Industroyer2](/stories/industroyer2) @@ -164,4 +167,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md index 05149cd412..2f50a9f881 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md @@ -107,8 +107,8 @@ The following analytic detects programs that have been started by forfiles.exe. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md index 8c73210d26..e5495c54bb 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md @@ -107,8 +107,8 @@ The following analytic detects programs that have been started by pcalua.exe. pc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index 30f6b3def1..0ef0c15aae 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -113,8 +113,8 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) Note that **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index 5166bb12b9..412990343b 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index dd92ad468f..07d1ba93b9 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md index 18579240aa..2cb72a0d22 100644 --- a/docs/_posts/2022-04-07-detect_html_help_renamed.md +++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md @@ -112,8 +112,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md index 332ace0b72..0dc321ea7e 100644 --- a/docs/_posts/2022-04-07-detect_mshta_renamed.md +++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md @@ -112,8 +112,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md index ec215a7e62..a594c9b36e 100644 --- a/docs/_posts/2022-04-07-detect_renamed_psexec.md +++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md @@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md index 84a98847ef..26265bcf01 100644 --- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md @@ -117,8 +117,8 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md index 9b02550696..707403df65 100644 --- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md +++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md @@ -122,8 +122,8 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md index 2f85bea2f1..9a1018c9ce 100644 --- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md @@ -122,8 +122,8 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md new file mode 100644 index 0000000000..a320268f4b --- /dev/null +++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md @@ -0,0 +1,173 @@ +--- +title: "Windows Registry Delete Task SD" +excerpt: "Scheduled Task +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-04-13 +toc: true +toc_label: "" +tags: + - Scheduled Task + - Impair Defenses + - Execution + - Persistence + - Privilege Escalation + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-13 +- **Author**: Michael Haag, Splunk +- **ID**: ffeb7893-ff06-446f-815b-33ca73224e92 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Installation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified) by _time Registry.dest Registry.process_guid Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data Registry.status Registry.action +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_registry_delete_task_sd_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +Note that **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.dest +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel. + +#### Associated Analytic story +* [Windows Registry Abuse](/stories/windows_registry_abuse) +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | A scheduled task security descriptor was deleted from the registry on $dest$. | + + +#### Reference + +* [https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/](https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/) +* [https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728](https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728) +* [https://gist.github.com/MHaggis/b246e2fae6213e762a6e694cabaf0c17](https://gist.github.com/MHaggis/b246e2fae6213e762a6e694cabaf0c17) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_registry_delete_task_sd.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md new file mode 100644 index 0000000000..e46c3e3851 --- /dev/null +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -0,0 +1,170 @@ +--- +title: "NLTest Domain Trust Discovery" +excerpt: "Domain Trust Discovery +" +categories: + - Endpoint +last_modified_at: 2022-04-18 +toc: true +toc_label: "" +tags: + - Domain Trust Discovery + - Discovery + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-04-18 +- **Author**: Michael Haag, Splunk +- **ID**: c3e05466-5f22-11eb-ae93-0242ac130002 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* PR.PT +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 8 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `nltest_domain_trust_discovery_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) + +Note that **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.user +* Processes.parent_process +* Processes.process_id +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Known False Positives +Administrators may use nltest for troubleshooting purposes, otherwise, rarely used. + +#### Associated Analytic story +* [Ryuk Ransomware](/stories/ryuk_ransomware) +* [Domain Trust Discovery](/stories/domain_trust_discovery) +* [IcedID](/stories/icedid) +* [Active Directory Discovery](/stories/active_directory_discovery) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 15.0 | 30 | 50 | Domain trust discovery execution on $dest$ | + + +#### Reference + +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md) +* [https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104](https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104) +* [https://attack.mitre.org/techniques/T1482/](https://attack.mitre.org/techniques/T1482/) +* [https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf](https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf) +* [https://ss64.com/nt/nltest.html](https://ss64.com/nt/nltest.html) +* [https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/](https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/) +* [https://thedfirreport.com/2020/10/08/ryuks-return/](https://thedfirreport.com/2020/10/08/ryuks-return/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/nltest_domain_trust_discovery.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md b/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md new file mode 100644 index 0000000000..41cebe7666 --- /dev/null +++ b/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md @@ -0,0 +1,159 @@ +--- +title: "Splunk XSS in Monitoring Console" +excerpt: "Drive-by Compromise +" +categories: + - Application +last_modified_at: 2022-04-27 +toc: true +toc_label: "" +tags: + - Drive-by Compromise + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-04-27 +- **Author**: Lou Stella, Splunk +- **ID**: b11accac-6fa3-4103-8a1a-7210f1a67087 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1189](https://attack.mitre.org/techniques/T1189/) | Drive-by Compromise | Initial Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + `splunkd_web` method="GET" uri_query="description=%3C*" +| table _time host status clientip user uri +| `splunk_xss_in_monitoring_console_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd_web](https://github.com/splunk/security_content/blob/develop/macros/splunkd_web.yml) + +Note that **splunk_xss_in_monitoring_console_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* method +* uri_query +* status +* clientip +* user +* uri + + +#### How To Implement +This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. + +#### Known False Positives +Use of the monitoring console where the less-than sign (<) is the first character in the description field. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | A potential XSS attempt has been detected from $user$ | + + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_xss_in_monitoring_console.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md new file mode 100644 index 0000000000..ae959435a3 --- /dev/null +++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md @@ -0,0 +1,163 @@ +--- +title: "Windows Computer Account Created by Computer Account" +excerpt: "Steal or Forge Kerberos Tickets +" +categories: + - Endpoint +last_modified_at: 2022-04-27 +toc: true +toc_label: "" +tags: + - Steal or Forge Kerberos Tickets + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifes a Computer Account creating a new Computer Account with specific a Service Principle Name - "RestrictedKrbHost". The RestrictedKrbHost service class allows client applications to use Kerberos authentication when they do not have the identity of the service but have the server name. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-27 +- **Author**: Michael Haag, Splunk +- **ID**: 97a8dc5f-8a7c-4fed-9e3e-ec407fd0268a + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`wineventlog_security` EventCode=4741 user_type=computer Subject_Account_Domain!="NT AUTHORITY" Message=*RestrictedKrbHost* +| stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action ,src_user, user, Account_Name, Subject_Account_Name,Subject_Account_Domain +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_computer_account_created_by_computer_account_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* dest +* subject +* action +* src_user +* user +* Account_Name +* Subject_Account_Name +* Subject_Account_Domain + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. + +#### Known False Positives +It is possible third party applications may have a computer account that adds computer accounts, filtering may be required. + +#### Associated Analytic story +* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks) +* [Local Privilege Escalation With KrbRelayUp](/stories/local_privilege_escalation_with_krbrelayup) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 30.0 | 50 | 60 | A Computer Account created a Computer Account on $dest$, possibly indicative of Kerberos relay attack. | + + +#### Reference + +* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/445e4499-7e49-4f2a-8d82-aaf2d1ee3c47](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/445e4499-7e49-4f2a-8d82-aaf2d1ee3c47) +* [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_computer_account_created_by_computer_account.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md new file mode 100644 index 0000000000..7db2b34f56 --- /dev/null +++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md @@ -0,0 +1,161 @@ +--- +title: "Windows Computer Account Requesting Kerberos Ticket" +excerpt: "Steal or Forge Kerberos Tickets +" +categories: + - Endpoint +last_modified_at: 2022-04-27 +toc: true +toc_label: "" +tags: + - Steal or Forge Kerberos Tickets + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a ComputerAccount requesting a Kerberos Ticket. typically, a user account requests a Kerberos ticket. This behavior was identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar behavior. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-27 +- **Author**: Michael Haag, Splunk +- **ID**: fb3b2bb3-75a4-4279-848a-165b42624770 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`wineventlog_security` EventCode=4768 Account_Name="*$" src_ip!="::1" +| stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action, Supplied_Realm_Name, user, Account_Name, src_ip +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_computer_account_requesting_kerberos_ticket_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* dest +* subject +* action +* Supplied_Realm_Name +* user +* Account_Name +* src_ip + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required. + +#### Known False Positives +It is possible false positives will be present based on third party applications. Filtering may be needed. + +#### Associated Analytic story +* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks) +* [Local Privilege Escalation With KrbRelayUp](/stories/local_privilege_escalation_with_krbrelayup) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 35.0 | 50 | 70 | A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack. | + + +#### Reference + +* [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md new file mode 100644 index 0000000000..d4ce350214 --- /dev/null +++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md @@ -0,0 +1,161 @@ +--- +title: "Windows Kerberos Local Successful Logon" +excerpt: "Steal or Forge Kerberos Tickets +" +categories: + - Endpoint +last_modified_at: 2022-04-27 +toc: true +toc_label: "" +tags: + - Steal or Forge Kerberos Tickets + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. The target user security identified will be set to the built-in local Administrator account, along with the remote address as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. Upon triage, review for recently ran binaries on disk. In addition, look for new computer accounts added to Active Directory and other anomolous AD events. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-27 +- **Author**: Michael Haag, Splunk +- **ID**: 8309c3a8-4d34-48ae-ad66-631658214653 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`wineventlog_security` EventCode=4624 Logon_Type=3 Authentication_Package=Kerberos action=success src_ip=127.0.0.1 +| stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action, Security_ID, user, Account_Name, src_ip +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_kerberos_local_successful_logon_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* dest +* subject +* action +* Security_ID +* user +* Account_Name +* src_ip + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. + +#### Known False Positives +False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed. + +#### Associated Analytic story +* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks) +* [Local Privilege Escalation With KrbRelayUp](/stories/local_privilege_escalation_with_krbrelayup) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack. | + + +#### Reference + +* [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_kerberos_local_successful_logon.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md new file mode 100644 index 0000000000..9c1cc95a39 --- /dev/null +++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md @@ -0,0 +1,165 @@ +--- +title: "Windows Computer Account With SPN" +excerpt: "Steal or Forge Kerberos Tickets +" +categories: + - Endpoint +last_modified_at: 2022-04-28 +toc: true +toc_label: "" +tags: + - Steal or Forge Kerberos Tickets + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added using the KrbRelayUp behavior. This particular behavior has been found in other Kerberos based attacks. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-28 +- **Author**: Michael Haag, Splunk +- **ID**: 9a3e57e7-33f4-470e-b25d-165baa6e8357 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Installation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`wineventlog_security` EventCode=4741 MSADChangedAttributes IN ("*HOST/*","*RestrictedKrbHost/*") AND New_UAC_Value=0x80 +| eval Effecting_Account=mvindex(Security_ID,1) +| eval New_Computer_Account_Name=mvindex(Security_ID,0) +| stats count min(_time) as firstTime max(_time) as lastTime values(EventCode),values(Account_Domain),values(Security_ID), values(Effecting_Account), values(New_Computer_Account_Name),values(SAM_Account_Name),values(DNS_Host_Name),values(MSADChangedAttributes) by dest Logon_ID subject +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_computer_account_with_spn_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventCode +* MSADChangedAttributes +* New_UAC_Value +* Security_ID +* Account_Domain +* SAM_Account_Name +* DNS_Host_Name +* Logon_Id + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. + +#### Known False Positives +It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed. + +#### Associated Analytic story +* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks) +* [Local Privilege Escalation With KrbRelayUp](/stories/local_privilege_escalation_with_krbrelayup) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack. | + + +#### Reference + +* [https://www.trustedsec.com/blog/an-attack-path-mapping-approach-to-cves-2021-42287-and-2021-42278](https://www.trustedsec.com/blog/an-attack-path-mapping-approach-to-cves-2021-42287-and-2021-42278) +* [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_computer_account_with_spn.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-29-path_traversal_spl_injection.md b/docs/_posts/2022-04-29-path_traversal_spl_injection.md new file mode 100644 index 0000000000..699ae9ad37 --- /dev/null +++ b/docs/_posts/2022-04-29-path_traversal_spl_injection.md @@ -0,0 +1,157 @@ +--- +title: "Path traversal SPL injection" +excerpt: "File and Directory Discovery +" +categories: + - Application +last_modified_at: 2022-04-29 +toc: true +toc_label: "" +tags: + - File and Directory Discovery + - Discovery + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-04-29 +- **Author**: Rod Soto, Splunk +- **ID**: dfe55688-82ed-4d24-a21b-ed8f0e0fda99 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1083](https://attack.mitre.org/techniques/T1083/) | File and Directory Discovery | Discovery | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + `path_traversal_spl_injection` +| search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" +| stats count by status clientip method uri_path uri_query +| `path_traversal_spl_injection_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [path_traversal_spl_injection](https://github.com/splunk/security_content/blob/develop/macros/path_traversal_spl_injection.yml) + +Note that **path_traversal_spl_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* status +* clientip +* method +* uri_path +* uri_query + + +#### How To Implement +This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. + +#### Known False Positives +This search may find additional path traversal exploitation attempts. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | Path traversal exploitation attempt from $clientip$ | + + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/path_traversal_spl_injection.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md new file mode 100644 index 0000000000..08a8f6fe4a --- /dev/null +++ b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md @@ -0,0 +1,162 @@ +--- +title: "Splunk User Enumeration Attempt" +excerpt: "Valid Accounts +" +categories: + - Application +last_modified_at: 2022-04-29 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Initial Access + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +On May 3rd, 2022, Splunk published a security advisory for username enumeration stemming from verbose login failure messages present on some REST endpoints. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-04-29 +- **Author**: Lou Stella, Splunk +- **ID**: 25625cb4-1c4d-4463-b0f9-7cb462699cde + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Reconnaissance + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + `splunkd_failed_auths` +| stats count(user) as auths by user, src +| where auths>5 +| stats values(user) as "Users", sum(auths) as TotalFailedAuths by src +| `splunk_user_enumeration_attempt_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd_failed_auths](https://github.com/splunk/security_content/blob/develop/macros/splunkd_failed_auths.yml) + +Note that **splunk_user_enumeration_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* user +* src +* info +* action + + +#### How To Implement +This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. + +#### Known False Positives +Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. | + + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_user_enumeration_attempt.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md new file mode 100644 index 0000000000..6e5c9ab5fa --- /dev/null +++ b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md @@ -0,0 +1,175 @@ +--- +title: "Linux Iptables Firewall Modification" +excerpt: "Disable or Modify System Firewall +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-04-30 +toc: true +toc_label: "" +tags: + - Disable or Modify System Firewall + - Impair Defenses + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-30 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1562.004](https://attack.mitre.org/techniques/T1562/004/) | Disable or Modify System Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path +| rex field=Processes.process "--dport (?3269 +|636 +|989 +|994 +|995 +|8443)" +| stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime +| where port_count >=3 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `linux_iptables_firewall_modification_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +Note that **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. + +#### Known False Positives +administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed. + +#### Associated Analytic story +* [Cyclops BLink](/stories/cyclops_blink) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | A commandline $process$ that may modify iptables firewall on $dest$ | + + +#### Reference + +* [https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf) +* [https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html](https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/linux_iptables_firewall_modification.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md new file mode 100644 index 0000000000..535738338f --- /dev/null +++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md @@ -0,0 +1,169 @@ +--- +title: "Linux Kworker Process In Writable Process Path" +excerpt: "Masquerade Task or Service +, Masquerading +" +categories: + - Endpoint +last_modified_at: 2022-04-30 +toc: true +toc_label: "" +tags: + - Masquerade Task or Service + - Masquerading + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common names of kernel threads in linux process. This hunting detections can lead to investigate process contains process path in writable directory in linux like /home/, /var/log and /tmp/. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-30 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1036.004](https://attack.mitre.org/techniques/T1036/004/) | Masquerade Task or Service | Defense Evasion | + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path Processes.process_guid Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `linux_kworker_process_in_writable_process_path_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +Note that **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_id +* Processes.parent_process_path +* Processes.process_path + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Cyclops BLink](/stories/cyclops_blink) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 36.0 | 60 | 60 | a $process_name$ with kworker commandline in $dest$ | + + +#### Reference + +* [https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf) +* [https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html](https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/linux_kworker_process_in_writable_process_path.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md new file mode 100644 index 0000000000..2934bda36f --- /dev/null +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -0,0 +1,159 @@ +--- +title: "Windows KrbRelayUp Service Creation" +excerpt: "Windows Service +" +categories: + - Endpoint +last_modified_at: 2022-05-02 +toc: true +toc_label: "" +tags: + - Windows Service + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the default service name created by KrbRelayUp. Defenders should be aware that attackers could change the hardcoded service name of the KrbRelayUp tool and bypass this detection. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-02 +- **Author**: Michael Haag, Splunk +- **ID**: e40ef542-8241-4419-9af4-6324582ea60a + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_krbrelayup_service_creation_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) + +Note that **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventCode +* Service_File_Name +* Service_Name +* Service_Start_Type +* Service_Type + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also required. + +#### Known False Positives +False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed. + +#### Associated Analytic story +* [Local Privilege Escalation With KrbRelayUp](/stories/local_privilege_escalation_with_krbrelayup) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | A service was created on $dest$, related to KrbRelayUp. | + + +#### Reference + +* [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/krbrelayup/krbrelayup.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_krbrelayup_service_creation.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/active_directory_kerberos_attacks.md b/docs/_stories/active_directory_kerberos_attacks.md index 33808b4147..63de7d0400 100644 --- a/docs/_stories/active_directory_kerberos_attacks.md +++ b/docs/_stories/active_directory_kerberos_attacks.md @@ -9,7 +9,9 @@ tags: - Splunk Cloud - Endpoint - Network_Traffic + - Actions on Objectives - Exploitation + - Installation - Reconnaissance --- @@ -52,9 +54,13 @@ Kerberos, initially named after Cerberus, the three-headed dog in Greek mytholog | [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts)| Hunting | | [Unknown Process Using The Kerberos Protocol](/endpoint/unknown_process_using_the_kerberos_protocol/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material)| TTP | | [Unusual Number of Kerberos Service Tickets Requested](/endpoint/unusual_number_of_kerberos_service_tickets_requested/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting)| Anomaly | +| [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | +| [Windows Computer Account Requesting Kerberos Ticket](/endpoint/windows_computer_account_requesting_kerberos_ticket/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | +| [Windows Computer Account With SPN](/endpoint/windows_computer_account_with_spn/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | | [Windows Disabled Users Failing To Authenticate Kerberos](/endpoint/windows_disabled_users_failing_to_authenticate_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Windows Get-AdComputer Unconstrained Delegation Discovery](/endpoint/windows_get-adcomputer_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery)| TTP | | [Windows Invalid Users Failed Authentication via Kerberos](/endpoint/windows_invalid_users_failed_authentication_via_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | +| [Windows Kerberos Local Successful Logon](/endpoint/windows_kerberos_local_successful_logon/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | | [Windows PowerView Constrained Delegation Discovery](/endpoint/windows_powerview_constrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery)| TTP | | [Windows PowerView Unconstrained Delegation Discovery](/endpoint/windows_powerview_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery)| TTP | | [Unusual Number of Computer Service Tickets Requested](/endpoint/unusual_number_of_computer_service_tickets_requested/) | [Valid Accounts](/tags/#valid-accounts)| Hunting | diff --git a/docs/_stories/industroyer2.md b/docs/_stories/industroyer2.md new file mode 100644 index 0000000000..e841f2c188 --- /dev/null +++ b/docs/_stories/industroyer2.md @@ -0,0 +1,57 @@ +--- +title: "Industroyer2" +last_modified_at: 2022-04-21 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Actions on Objectives + - Exploitation + - Reconnaissance +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +Leverage searches that allow you to detect and investigate unusual activities that might relate to the Industroyer2 attack, including file writes associated with its payload, lateral movement, persistence, privilege escalation and data destruction. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-21 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a + +#### Narrative + +Industroyer2 is part of continuous attack to ukraine targeting energy facilities. This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments. This attack consist of several destructive linux script component to wipe or delete several linux critical files, powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | +| [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP | +| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP | +| [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service)| TTP | +| [Linux DD File Overwrite](/endpoint/linux_dd_file_overwrite/) | [Data Destruction](/tags/#data-destruction)| TTP | +| [Linux System Network Discovery](/endpoint/linux_system_network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery)| Anomaly | +| [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | +| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | +| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task)| Hunting | +| [Linux Stdout Redirection To Dev Null File](/endpoint/linux_stdout_redirection_to_dev_null_file/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| Anomaly | + +#### Reference + +* [https://cert.gov.ua/article/39518](https://cert.gov.ua/article/39518) +* [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/industroyer2.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/local_privilege_escalation_with_krbrelayup.md b/docs/_stories/local_privilege_escalation_with_krbrelayup.md new file mode 100644 index 0000000000..edd27fba58 --- /dev/null +++ b/docs/_stories/local_privilege_escalation_with_krbrelayup.md @@ -0,0 +1,52 @@ +--- +title: "Local Privilege Escalation With KrbRelayUp" +last_modified_at: 2022-04-28 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Actions on Objectives + - Exploitation + - Installation +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-04-28 +- **Author**: Michael Haag, Mauricio Velazco, Splunk +- **ID**: 765790f0-2f8f-4048-8321-fd1928ec2546 + +#### Narrative + +In October 2021, James Forshaw from Googles Project Zero released a research blog post titled `Using Kerberos for Authentication Relay Attacks`. This research introduced, for the first time, ways to make Windows authenticate to a different Service Principal Name (SPN) than what would normally be derived from the hostname the client is connecting to. This effectively proved that relaying Kerberos authentication is possible\\. In April 2022, security researcher Mor Davidovich released a tool named KrbRelayUp which implements Kerberos relaying as well as other known Kerberos techniques with the goal of escalating privileges from a low-privileged domain user on a domain-joined device and obtain a SYSTEM shell. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | +| [Windows Computer Account Requesting Kerberos Ticket](/endpoint/windows_computer_account_requesting_kerberos_ticket/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | +| [Windows Computer Account With SPN](/endpoint/windows_computer_account_with_spn/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | +| [Windows Kerberos Local Successful Logon](/endpoint/windows_kerberos_local_successful_logon/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets)| TTP | +| [Windows KrbRelayUp Service Creation](/endpoint/windows_krbrelayup_service_creation/) | [Windows Service](/tags/#windows-service)| TTP | + +#### Reference + +* [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) +* [https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9](https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9) +* [https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html](https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html) +* [https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/](https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/) +* [https://github.com/cube0x0/KrbRelay](https://github.com/cube0x0/KrbRelay) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/local_privilege_escalation_with_krbrelayup.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md index 62a87b3a5c..0ccde941fb 100644 --- a/docs/_stories/ransomware.md +++ b/docs/_stories/ransomware.md @@ -79,7 +79,6 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution)| TTP | | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry)| TTP | | [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | -| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs)| TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | @@ -102,6 +101,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool)| TTP | | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools)| TTP | +| [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [MS Exchange Mailbox Replication service writing Active Server Pages](/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | diff --git a/docs/_stories/spearphishing_attachments.md b/docs/_stories/spearphishing_attachments.md index e41084b62b..7b643da1de 100644 --- a/docs/_stories/spearphishing_attachments.md +++ b/docs/_stories/spearphishing_attachments.md @@ -9,6 +9,7 @@ tags: - Splunk Cloud - Endpoint - Actions on Objectives + - Delivery - Exploitation - Installation --- @@ -55,6 +56,7 @@ This Analytic Story focuses on detecting signs that a malicious payload has been | [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Spawning Control](/endpoint/office_spawning_control/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Phishing](/tags/#phishing), [Spearphishing Link](/tags/#spearphishing-link)| TTP | +| [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution)| Hunting | | [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Gdrive suspicious file sharing](/cloud/gdrive_suspicious_file_sharing/) | [Phishing](/tags/#phishing)| Hunting | diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md index 0b6d32d169..062660f7ef 100644 --- a/docs/_stories/splunk_vulnerabilities.md +++ b/docs/_stories/splunk_vulnerabilities.md @@ -9,6 +9,7 @@ tags: - Splunk Cloud - Delivery - Exploitation + - Reconnaissance --- [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -31,14 +32,16 @@ This analytic story includes detections that focus on attacker behavior targeted | Name | Technique | Type | | ----------- | ----------- |--------------| +| [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery)| TTP | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service)| TTP | +| [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts)| TTP | +| [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | | [Open Redirect in Splunk Web](/deprecated/open_redirect_in_splunk_web/) | None| TTP | | [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None| TTP | #### Reference -* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html) -* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422) +* [https://www.splunk.com/en_us/product-security/announcements.html](https://www.splunk.com/en_us/product-security/announcements.html) diff --git a/docs/_stories/windows_drivers.md b/docs/_stories/windows_drivers.md new file mode 100644 index 0000000000..882a602717 --- /dev/null +++ b/docs/_stories/windows_drivers.md @@ -0,0 +1,44 @@ +--- +title: "Windows Drivers" +last_modified_at: 2022-03-30 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-03-30 +- **Author**: Michael Haag, Splunk +- **ID**: d0a9323f-9411-4da6-86b2-18c184d750c0 + +#### Narrative + +A rootkit on Windows may sometimes be in the form of a Windows Driver. A driver typically has a file extension of .sys, however the internals of a sys file is similar to a Windows DLL. For Microsoft Windows to load a driver, a few requirements are needed. First, it must have a valid signature. Second, typically it should load from the windows\system32\drivers path. There are a few methods to investigate drivers in the environment. Drivers are noisy. An inventory of all drivers is important to understand prevalence. A driver location (Path) is also important when attempting to baseline. Looking at a driver name and path is not enough, we must also explore the signing information. Product, description, company name, signer and signing result are all items to take into account when reviewing drivers. What makes a driver malicious? Depending if a driver was dropped during a campaign or you are baselining drivers after, triaging a driver to determine maliciousness may be tough. We break this into two categories - 1. vulnerable drivers 2. driver rootkits. Attempt to identify prevelance of the driver. Is it on one or many? Review the signing information if it is present. Is it common? A lot of driver hunting will lead down rabbit holes, but we hope to help lead the way. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Windows Drivers Loaded by Signature](/endpoint/windows_drivers_loaded_by_signature/) | [Rootkit](/tags/#rootkit)| Hunting | +| [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls)| TTP | +| [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | + +#### Reference + +* [https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/](https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/windows_drivers.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md index 926cd4311f..71c20e448b 100644 --- a/docs/_stories/windows_persistence_techniques.md +++ b/docs/_stories/windows_persistence_techniques.md @@ -56,6 +56,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i | [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | +| [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness)| TTP | | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | diff --git a/docs/_stories/windows_registry_abuse.md b/docs/_stories/windows_registry_abuse.md index d4945297f5..26ee941b36 100644 --- a/docs/_stories/windows_registry_abuse.md +++ b/docs/_stories/windows_registry_abuse.md @@ -11,6 +11,7 @@ tags: - Actions on Objectives - Delivery - Exploitation + - Installation --- [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -86,6 +87,9 @@ Windows Registry is one of the powerful and yet still mysterious Windows feature | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP | +| [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls)| TTP | +| [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses)| TTP | +| [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness)| TTP | | [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |