diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 4fe9ee9bad..b16e060915 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -76,4 +76,5 @@ tags: - Processes.parent_process_name - Processes.parent_process risk_score: 42 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index 6453a543b4..7418274594 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -87,5 +87,5 @@ tags: - process - cmd_line risk_score: 36 - risk_severity: high + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 88ddd15bcb..3660e44937 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -86,5 +86,5 @@ tags: - dest_user_id - process risk_score: 36 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 531fd0e392..05b0c6277c 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -77,5 +77,5 @@ tags: - process - cmd_line risk_score: 63 - risk_severity: low + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index daae967aa8..6420315de8 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -86,5 +86,5 @@ tags: - process - cmd_line risk_score: 49 - risk_severity: high + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 6a3ade760d..4c295c9ac6 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -73,5 +73,5 @@ tags: - process - cmd_line risk_score: 35 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 187ab0a6e6..805aa68620 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -68,5 +68,5 @@ tags: - dest_device_id - process risk_score: 70 - risk_severity: low + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml index b071149c60..6e6f9dfd95 100644 --- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -88,4 +88,5 @@ tags: - process - cmd_line risk_score: 35 + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index f83a0091bf..0c3c7f76f6 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -85,5 +85,5 @@ tags: - process - cmd_line risk_score: 49 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index b6fdef2913..08e143cb3b 100644 --- a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -85,4 +85,5 @@ tags: - process - cmd_line risk_score: 72 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml b/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml index 52edec9e37..c997c19f28 100644 --- a/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml +++ b/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml @@ -46,4 +46,5 @@ tags: - file_name - file_path risk_score: 72 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml index 3399c9ac7e..60e3bf6905 100644 --- a/detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -78,7 +78,7 @@ tags: - process - cmd_line risk_score: 54 - risk_severity: high + risk_severity: medium security_domain: endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log \ No newline at end of file diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index cd874d9edd..a61baf888f 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -73,5 +73,5 @@ tags: - process - cmd_line risk_score: 35 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___high_file_deletion_frequency.yml b/detections/endpoint/ssa___high_file_deletion_frequency.yml index b377297dc0..44820b1827 100644 --- a/detections/endpoint/ssa___high_file_deletion_frequency.yml +++ b/detections/endpoint/ssa___high_file_deletion_frequency.yml @@ -67,4 +67,5 @@ tags: - file_name - file_path risk_score: 72 + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 944c08e1bf..ddcc59506f 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -76,5 +76,5 @@ tags: - process - cmd_line risk_score: 35 - risk_severity: medium + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index 2f0e28df62..9b57893592 100644 --- a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -93,5 +93,5 @@ tags: - dest_device_id - authentication_method risk_score: 72 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index 51f2eff5e9..13fc3309bb 100644 --- a/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -94,5 +94,5 @@ tags: - origin_device_id - authentication_method risk_score: 64 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 1ee19a2616..a97db6024c 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -85,5 +85,5 @@ tags: - process - cmd_line risk_score: 64 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index 66a706b8d0..f9538df11b 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -91,4 +91,5 @@ tags: - process_path - cmd_line risk_score: 42 + risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 3c49c33a0d..d0a26b352e 100644 --- a/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -272,5 +272,5 @@ tags: - dest_user_id - process_path risk_score: 56 - risk_severity: low + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml index ced98b05dd..8473101552 100644 --- a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -82,7 +82,7 @@ tags: - process - cmd_line risk_score: 15 - risk_severity: high + risk_severity: low security_domain: endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log \ No newline at end of file diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index f16d61ebc4..9b5a7c19ff 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -74,5 +74,5 @@ tags: - dest_user_id - process risk_score: 63 - risk_severity: high + risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 64d3c29009..da3a6dc607 100644 --- a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -96,4 +96,5 @@ tags: - process - cmd_line risk_score: 80 + risk_severity: high security_domain: endpoint