Updated detection files with recommended TA list.

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -6,23 +6,27 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. 
-  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
-  Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+description: The following analytic looks for the use of Mimikatz command line parameters
+  leveraged to execute pass the ticket attacks. Red teams and adversaries alike may
+  use the pass the ticket technique using stolen Kerberos tickets to move laterally
+  within an environment, bypassing normal system access controls. Defenders should
+  be aware that adversaries may customize the source code of Mimikatz and modify the
+  command line parameters. This would effectively bypass this analytic.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" 
-  OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets
+  /export*" OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+known_false_positives: Although highly unlikely, legitimate applications may use the
+  same command line parameters as Mimikatz.
 references:
 - https://github.com/gentilkiwi/mimikatz
-- https://attack.mitre.org/techniques/T1550/003/  
+- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -49,12 +53,13 @@ tags:
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 60
-  confidence: 60 
+  confidence: 60
   risk_score: 36
   context:
   - Source:Endpoint
   - Stage:PrivilegeEscalation
-  message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ 
+  message: Mimikatz command line parameters for pass the ticket attacks were used
+    on $dest$
   observable:
   - name: user
     type: User
@@ -67,4 +72,6 @@ tags:
   - name: parent_process_name
     type: Parent Process
     role:
-    - Parent Process
+    - Parent Process
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/net_profiler_uac_bypass.yml

@@ -12,14 +12,11 @@ description: This search is to detect modification of registry to bypass UAC win
   the registry key and values in the detection area. It may happened that windows
   update some dll related to mmc.exe and add dll path in this registry. In this case
   filtering is needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
-  from datamodel=Endpoint.Registry where 
-  Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" 
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `net_profiler_uac_bypass_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
+  Registry.registry_value_data = "*.dll" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -9,7 +9,8 @@ datamodel:
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
+  where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
+  OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
   OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*

detections/endpoint/rubeus_command_line_parameters.yml

@@ -6,16 +6,23 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs 
-  MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets,
-  forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks.
-  Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is
+  heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin
+  project. This analytic looks for the use of Rubeus command line arguments utilized
+  in common Kerberos attacks like exporting and importing tickets, forging silver
+  and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc.
+  Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory
+  networks. Defenders should be aware that adversaries may customize the source code
+  of Rubeus and modify the command line parameters. This would effectively bypass
+  this analytic.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" 
-  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" 
-  OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" 
-  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*"
-  OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
+  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR
+  Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*"
+  OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*"
+  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*"
+  OR Processes.process = "* brute* /password:*" OR Processes.process = "* brute* /passwords:*"
+  OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
@@ -23,11 +30,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+known_false_positives: Although unlikely, legitimate applications may use the same
+  command line parameters as Rubeus. Filter as needed.
 references:
-- https://github.com/GhostPack/Rubeus 
-- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ 
-- https://attack.mitre.org/techniques/T1550/003/ 
+- https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -57,12 +65,12 @@ tags:
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 60
-  confidence: 60 
+  confidence: 60
   risk_score: 36
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: Rubeus command line parameters were used on $dest$ 
+  message: Rubeus command line parameters were used on $dest$
   observable:
   - name: user
     type: User
@@ -76,3 +84,5 @@ tags:
     type: Parent Process
     role:
     - Parent Process
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -82,3 +82,5 @@ tags:
   - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -6,19 +6,25 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with
-  the Dragonfly threat actor, and the SUNBURST attack against Solarwinds.
-  This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
+description: The following analytic identifies the creation or deletion of a scheduled
+  task using schtasks.exe with flags - create or delete being passed on the command-line.
+  This has been associated with the Dragonfly threat actor, and the SUNBURST attack
+  against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name
   Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: It is possible scripts or administrators may trigger this analytic. Filter as needed based on parent process, application.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible scripts or administrators may trigger this analytic.
+  Filter as needed based on parent process, application.
 references:
-  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
+- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
 tags:
   analytic_story:
   - DHS Report TA18-074A

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -8,14 +8,12 @@ datamodel:
 - Endpoint
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
-  datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* 
-  Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass) 
-  by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*
+  Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted
+  OR Registry.registry_value_data=Bypass) by Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Registry node. You must also be
   ingesting logs with the fields registry_path, registry_key_name, and registry_value_name

detections/endpoint/windows_disable_memory_crash_dump.yml

@@ -6,28 +6,33 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper.
-  To disable crash dumps, the value must be set to 0. 
-  This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check).
+description: The following analytic identifies a process that is attempting to disable
+  the ability on Windows to generate a memory crash dump. This was recently identified
+  being utilized by HermeticWiper. To disable crash dumps, the value must be set to
+  0. This feature is typically modified to perform a memory crash dump when a computer
+  stops unexpectedly because of a Stop error (also known as a blue screen, system
+  crash, or bug check).
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
+  where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled")
+  AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
   Registry.registry_path Registry.registry_value_name Registry.registry_value_data
   Registry.process_guid Registry.registry_key_name  | `drop_dm_object_name(Registry)`
-  |join process_guid [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
-  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
-  Processes.process_guid | `drop_dm_object_name(Processes)`  | fields _time dest user parent_process_name parent_process process_name
-  process_path process process_guid registry_path registry_value_name registry_value_data
-  registry_key_name] | table _time dest user parent_process_name parent_process process_name
-  process_path process process_guid registry_path registry_value_name registry_value_data
-  registry_key_name | `windows_disable_memory_crash_dump_filter`'
+  |join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)`  | fields _time dest user parent_process_name parent_process
+  process_name process_path process process_guid registry_path registry_value_name
+  registry_value_data registry_key_name] | table _time dest user parent_process_name
+  parent_process process_name process_path process process_guid registry_path registry_value_name
+  registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node.
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry`
+  node.
 known_false_positives: unknown
 references:
-  - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
-  - https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
 tags:
   analytic_story:
   - Data Destruction
@@ -45,29 +50,29 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Filesystem.file_create_time 
-  - Filesystem.process_id 
-  - Filesystem.file_name 
-  - Filesystem.user 
-  - Filesystem.file_path 
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
   - Filesystem.dest
-  - Processes.process_id 
+  - Processes.process_id
   - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
   - Processes.parent_process
   - Processes.process_guid
   security_domain: endpoint
   impact: 90
-  confidence: 100 
-  # (impact * confidence)/100
+  confidence: 100
   risk_score: 90
-  context: 
+  context:
   - Source:Endpoint
   - Stage:Persistence
   - Privilege Escalation
-  message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$.
+  message: A process $process_name$ was identified attempting to disable memory crash
+    dumps on $dest$.
   observable:
   - name: user
     type: User
@@ -90,4 +95,6 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16 
+  - CIS 16
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_file_without_extension_in_critical_folder.yml

@@ -6,32 +6,29 @@ author: Teoderick Contreras, Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. 
-  This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) 
-  and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive 
-  malware that wipes the boot sector of the system.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") 
-  by _time span=5m Filesystem.dest Filesystem.user
-  Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.file_create_time 
-  | `drop_dm_object_name(Filesystem)` 
-  | rex field="file_name" "\.(?<extension>[^\.]*$)" 
-  | where isnull(extension)
-  | join process_guid 
-  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-      by _time span=5m Processes.process_name Processes.dest Processes.process_guid
-      Processes.user 
-  | `drop_dm_object_name(Processes)`] 
-  | stats count min(_time) as firstTime max(_time)
-  as lastTime by dest process_name process_guid file_name file_path file_create_time user 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+description: This analytic is to look for suspicious file creation in the critical
+  folder like "System32\Drivers" folder without file extension. This artifacts was
+  seen in latest hermeticwiper where it drops its driver component in Driver Directory
+  both the compressed(without file extension) and the actual driver component (with
+  .sys file extension). This TTP is really a good indication that a host might be
+  compromised by this destructive malware that wipes the boot sector of the system.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*")
+  by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path
+  Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)`
+  | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) | join
+  process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user
+  | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_file_without_extension_in_critical_folder_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Unknown at this point
 references:
--  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
   analytic_story:
   - Data Destruction
@@ -48,22 +45,21 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Filesystem.file_create_time 
-  - Filesystem.process_id 
-  - Filesystem.file_name 
-  - Filesystem.user 
-  - Filesystem.file_path 
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
   - Filesystem.dest
-  - Processes.process_name 
-  - Processes.dest 
+  - Processes.process_name
+  - Processes.dest
   - Processes.process_guid
-  - Processes.user 
+  - Processes.user
   security_domain: endpoint
   impact: 90
-  confidence: 100 
-  # (impact * confidence)/100
+  confidence: 100
   risk_score: 90
-  context: 
+  context:
   - Source:Endpoint
   - Stage:Persistence
   - Privilege Escalation
@@ -79,3 +75,5 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml

@@ -6,14 +6,17 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious registry modification related to file compression color and information tips. 
-  This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS 
-  file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions 
-  related to file compression attribution in terms of color in NTFS file system.
+description: This analytic is to look for suspicious registry modification related
+  to file compression color and information tips. This IOC was seen in hermetic wiper
+  where it has a thread that will create this registry entry to change the color of
+  compressed or encrypted files in NTFS file system as well as the pop up information
+  tips. This is a good indicator that a process tries to modified one of the registry
+  GlobalFolderOptions related to file compression attribution in terms of color in
+  NTFS file system.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" 
-  AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip") 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
+  AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip") by _time span=1h
+  Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
   Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
   |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
   count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -22,14 +25,13 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   proc_guid | fields _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
-known_false_positives: unknown 
+known_false_positives: unknown
 references:
--  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -53,7 +55,6 @@ tags:
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
   - Source:Endpoint
@@ -69,4 +70,6 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_process_with_namedpipe_commandline.yml

@@ -6,26 +6,29 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to look for process commandline that contains named pipe. 
-  This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process 
-  injection that serve as defense evasion and privilege escalation. On the other hand this analytic may catch some normal process that using this technique for example browser 
-  application. In that scenario we include common process path we've seen during testing that cause false positive which is the program files. 
-  False positive may still be arise if the normal application is in other folder path.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process = "*\\\\.\\pipe\\*" NOT (Processes.process_path IN ("*\\program files*"))
-  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id
-  Processes.parent_process_path Processes.process_guid Processes.parent_process_id Processes.dest Processes.user Processes.process_path
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_process_with_namedpipe_commandline_filter`'
+description: This analytic is to look for process commandline that contains named
+  pipe. This technique was seen in some adversaries, threat actor and malware like
+  olympic destroyer to communicate to its other child processes after process injection
+  that serve as defense evasion and privilege escalation. On the other hand this analytic
+  may catch some normal process that using this technique for example browser application.
+  In that scenario we include common process path we've seen during testing that cause
+  false positive which is the program files. False positive may still be arise if
+  the normal application is in other folder path.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*"
+  NOT (Processes.process_path IN ("*\\program files*")) by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id
+  Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Normal browser application may use this technique. Please update the filter macros to remove false positives.
+known_false_positives: Normal browser application may use this technique. Please update
+  the filter macros to remove false positives.
 references:
--  https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -52,13 +55,12 @@ tags:
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
-  - Processes.process_guid 
+  - Processes.process_guid
   security_domain: endpoint
   impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
   risk_score: 49
-  context: 
+  context:
   - Source:Endpoint
   - Stage:Defense Evasion
   message: Process with named pipe in $process$ on $dest$
@@ -72,4 +74,6 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_rasautou_dll_execution.yml

@@ -78,3 +78,5 @@ tags:
   - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_remote_assistance_spawning_process.yml

@@ -75,3 +75,5 @@ tags:
   - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_schtasks_create_run_as_system.yml

@@ -72,3 +72,5 @@ tags:
   - Processes.parent_process_id
   risk_score: 48
   security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -6,30 +6,33 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious modification or creation of registry to have service entry. 
-  This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. 
-  This technique can be executed using reg.exe application or using windows API like for example the CrashOveride malware. 
-  This detection is a good indicator that a process is trying to create a service entry using registry ImagePath.
+description: This analytic is to look for suspicious modification or creation of registry
+  to have service entry. This technique is abused by adversaries or threat actor to
+  persist, gain privileges in the machine or even lateral movement. This technique
+  can be executed using reg.exe application or using windows API like for example
+  the CrashOveride malware. This detection is a good indicator that a process is trying
+  to create a service entry using registry ImagePath.
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*"
+  Registry.registry_value_name = ImagePath by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
   Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
   Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
   proc_guid | fields _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_service_creation_using_registry_entry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_service_creation_using_registry_entry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
   that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: Third party tools may used this technique to create services but not so common.
+known_false_positives: Third party tools may used this technique to create services
+  but not so common.
 references:
--  https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
+- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -52,19 +55,18 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  - Processes.process_id 
+  - Processes.process_id
   - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
   - Processes.parent_process
   - Processes.process_guid
   security_domain: endpoint
   impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
+  confidence: 80
   risk_score: 64
-  context: 
+  context:
   - Source:Endpoint
   - Stage:Lateral Movement
   - Stage:Persistence
@@ -80,4 +82,6 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/wsreset_uac_bypass.yml

@@ -36,7 +36,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
-  - Living Off The Land 
+  - Living Off The Land
   confidence: 90
   context:
   - Source:Endpoint

security_content_automation/detection_ta_mapping.csv

@@ -25,6 +25,7 @@ windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,S
 spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
+windows_file_without_extension_in_critical_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
 domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
@@ -38,11 +39,13 @@ disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonbla
 powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon
 disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_rasautou_dll_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_disable_memory_crash_dump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
@@ -78,6 +81,7 @@ scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Sp
 sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+windows_remote_assistance_spawning_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
@@ -102,6 +106,7 @@ linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carb
 nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+suspicious_linux_discovery_commands,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
@@ -148,6 +153,7 @@ windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsof
 excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+windows_modify_show_compress_color_and_info_tip_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
@@ -166,6 +172,7 @@ revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-car
 detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+windows_service_creation_using_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
@@ -210,10 +217,12 @@ elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_mi
 registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_system_network_discovery,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+rubeus_command_line_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
 office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
@@ -232,6 +241,7 @@ disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Spl
 sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
+rundll_loading_dll_by_ordinal,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
@@ -264,6 +274,7 @@ schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-car
 schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+mimikatz_passtheticket_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
@@ -274,6 +285,7 @@ attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"
 process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_dd_file_overwrite,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
@@ -300,9 +312,11 @@ etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmo
 process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
 samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
 impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_process_with_namedpipe_commandline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+windows_schtasks_create_run_as_system,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
 bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
 suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon

security_content_automation/detection_ta_mapping.yml

@@ -1092,6 +1092,12 @@ linux_change_file_owner_to_root:
   - Splunk_TA_bit9-carbonblack
   - Splunk_TA_microsoft_sysmon
   - Splunk_TA_CrowdStrike_FDR
+linux_dd_file_overwrite:
+  cim_version: 5.0.0
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_CrowdStrike_FDR
 linux_doas_conf_file_creation:
   cim_version: 5.0.0
   tas_with_cim_mapping:
@@ -1219,6 +1225,12 @@ linux_sudoers_tmp_file_creation:
   tas_with_cim_mapping:
   - Splunk_TA_bit9-carbonblack
   - Splunk_TA_microsoft_sysmon
+linux_system_network_discovery:
+  cim_version: 5.0.0
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_CrowdStrike_FDR
 linux_visudo_utility_execution:
   cim_version: 5.0.0
   tas_with_cim_mapping:
@@ -1244,6 +1256,13 @@ malicious_powershell_process_with_obfuscation_techniques:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+mimikatz_passtheticket_commandline_parameters:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
 mmc_exe_lolbas_execution_process_spawn:
   cim_version: 5.0.0
   supported_tas:
@@ -1561,6 +1580,13 @@ revil_registry_entry:
   tas_with_cim_mapping:
   - Splunk_TA_bit9-carbonblack
   - Splunk_TA_microsoft_sysmon
+rubeus_command_line_parameters:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
 rundll32_control_rundll_world_writable_directory:
   cim_version: 5.0.0
   supported_tas:
@@ -1579,6 +1605,12 @@ rundll32_with_no_command_line_arguments_with_network:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+rundll_loading_dll_by_ordinal:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_microsoft_sysmon
 ryuk_wake_on_lan_command:
   cim_version: 5.0.0
   supported_tas:
@@ -1807,6 +1839,12 @@ suspicious_icedid_rundll32_cmdline:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+suspicious_linux_discovery_commands:
+  cim_version: 5.0.0
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_CrowdStrike_FDR
 suspicious_microsoft_workflow_compiler_usage:
   cim_version: 5.0.0
   supported_tas:
@@ -2025,6 +2063,13 @@ windows_defender_exclusion_registry_entry:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+windows_disable_memory_crash_dump:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
 windows_disableantispyware_reg:
   cim_version: 5.0.0
   supported_tas:
@@ -2044,6 +2089,13 @@ windows_dotnet_binary_in_non_standard_path:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+windows_file_without_extension_in_critical_folder:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
 windows_installutil_credential_theft:
   cim_version: 5.0.0
   supported_tas:
@@ -2068,24 +2120,62 @@ windows_installutil_url_in_command_line:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+windows_modify_show_compress_color_and_info_tip_registry:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
 windows_nirsoft_advancedrun:
   cim_version: 5.0.0
   supported_tas:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+windows_process_with_namedpipe_commandline:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_microsoft_sysmon
 windows_raccine_scheduled_task_deletion:
   cim_version: 5.0.0
   supported_tas:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+windows_rasautou_dll_execution:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_microsoft_sysmon
+windows_remote_assistance_spawning_process:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_microsoft_sysmon
+windows_schtasks_create_run_as_system:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_microsoft_sysmon
 windows_service_creation_on_remote_endpoint:
   cim_version: 5.0.0
   supported_tas:
   - Splunk_TA_microsoft_sysmon
   tas_with_cim_mapping:
   - Splunk_TA_microsoft_sysmon
+windows_service_creation_using_registry_entry:
+  cim_version: 5.0.0
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  tas_with_cim_mapping:
+  - Splunk_TA_bit9-carbonblack
+  - Splunk_TA_microsoft_sysmon
 windows_service_initiation_on_remote_endpoint:
   cim_version: 5.0.0
   supported_tas: