Merge pull request #1723 from splunk/CARS_UPDATE_MITRE_ID_B5

Cars update mitre id b5

detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml

@@ -49,6 +49,7 @@ tags:
   - Reconnaissance
   message: System group discovery enumeration on $dest$ by $user$.
   mitre_attack_id:
+  - T1069
   - T1069.001
   observable:
   - name: dest

detections/endpoint/getadgroup_with_powershell.yml

@@ -40,6 +40,7 @@ tags:
   - Reconnaissance
   message: Domain group discovery enumeration on $dest$ by $user$
   mitre_attack_id:
+  - T1069
   - T1069.002
   observable:
   - name: dest

detections/endpoint/getadgroup_with_powershell_script_block.yml

@@ -38,6 +38,7 @@ tags:
   - Reconnaissance
   message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
+  - T1069
   - T1069.002
   observable:
   - name: dest

detections/endpoint/getdomaingroup_with_powershell.yml

@@ -40,6 +40,7 @@ tags:
   - Reconnaissance
   message: Domain group discovery with PowerView on $dest$ by $user$
   mitre_attack_id:
+  - T1069
   - T1069.002
   observable:
   - name: dest

detections/endpoint/getdomaingroup_with_powershell_script_block.yml

@@ -39,6 +39,7 @@ tags:
   - Reconnaissance
   message: Domain group discovery enumeration using PowerView on $dest$ by $user$
   mitre_attack_id:
+  - T1069
   - T1069.002
   observable:
   - name: dest

detections/endpoint/getlocaluser_with_powershell.yml

@@ -38,6 +38,7 @@ tags:
   - Reconnaissance
   message: Local user discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
+  - T1087
   - T1087.001
   observable:
   - name: dest

detections/endpoint/getlocaluser_with_powershell_script_block.yml

@@ -36,6 +36,7 @@ tags:
   - Reconnaissance
   message: Local user discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
+  - T1087
   - T1087.001
   observable:
   - name: dest

detections/endpoint/getwmiobject_ds_group_with_powershell.yml

@@ -42,6 +42,7 @@ tags:
   - Reconnaissance
   message: Domain group discovery enumeration on $dest$ by $user$
   mitre_attack_id:
+  - T1069
   - T1069.002
   observable:
   - name: dest

detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml

@@ -39,6 +39,7 @@ tags:
   - Reconnaissance
   message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
+  - T1069
   - T1069.002
   observable:
   - name: dest

detections/endpoint/getwmiobject_ds_user_with_powershell.yml

@@ -43,6 +43,7 @@ tags:
   message: an instance of process $process_name$ with commandline $process$ in $dest$
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: user
     type: User

detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml

@@ -38,6 +38,7 @@ tags:
   message: powershell process having commandline $Message$ for user enumeration
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: ComputerName
     type: Hostname

detections/endpoint/getwmiobject_user_account_with_powershell.yml

@@ -39,6 +39,7 @@ tags:
   - Reconnaissance
   message: Local user discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
+  - T1087
   - T1087.001
   observable:
   - name: dest

detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml

@@ -36,6 +36,7 @@ tags:
   - Reconnaissance
   message: Local user discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
+  - T1087
   - T1087.001
   observable:
   - name: dest

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -45,6 +45,7 @@ tags:
     by $user$
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml

@@ -43,6 +43,7 @@ tags:
   - Actions on Objectives
   message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
   mitre_attack_id:
+  - T1222
   - T1222.001
   nist:
   - DE.CM

detections/endpoint/icedid_exfiltrated_archived_file_creation.yml

@@ -36,6 +36,7 @@ tags:
   message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: Computer
     type: Hostname

detections/endpoint/jscript_execution_using_cscript_app.yml

@@ -42,6 +42,7 @@ tags:
   message: Process name $process_name$ with commandline $process$ to execute jscript
     in $dest$
   mitre_attack_id:
+  - T1059
   - T1059.007
   observable:
   - name: dest

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -39,6 +39,7 @@ tags:
     on $dest$
   mitre_attack_id:
   - T1558.003
+  - T1558
   nist:
   - DE.CM
   observable:

detections/endpoint/local_account_discovery_with_net.yml

@@ -37,6 +37,7 @@ tags:
   - Reconnaissance
   message: Local user discovery enumeration on $dest$ by $user$
   mitre_attack_id:
+  - T1087
   - T1087.001
   observable:
   - name: dest

detections/endpoint/local_account_discovery_with_wmic.yml

@@ -36,6 +36,7 @@ tags:
   - Reconnaissance
   message: Local user discovery enumeration on $dest$ by $user$
   mitre_attack_id:
+  - T1087
   - T1087.001
   observable:
   - name: dest

detections/endpoint/logon_script_event_trigger_execution.yml

@@ -33,6 +33,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
+  - T1037
   - T1037.001
   product:
   - Splunk Enterprise

detections/endpoint/mailsniper_invoke_functions.yml

@@ -38,6 +38,7 @@ tags:
   message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user
     $user$.
   mitre_attack_id:
+  - T1114
   - T1114.001
   observable:
   - name: dest

detections/endpoint/malicious_powershell_executed_as_a_service.yml

@@ -39,6 +39,7 @@ tags:
   message: Identifies the abuse the Windows SC.exe to execute malicious powerShell
     as a service $Service_File_Name$ by $user$ on $dest$
   mitre_attack_id:
+  - T1569
   - T1569.002
   observable:
   - name: dest

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -49,6 +49,7 @@ tags:
   - Actions on Objectives
   message: PowerShell local execution policy bypass attempt on $dest$
   mitre_attack_id:
+  - T1059
   - T1059.001
   nist:
   - PR.PT

detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml

@@ -47,6 +47,7 @@ tags:
   - Actions on Objectives
   message: Powershell.exe running with potential obfuscated arguments on $dest$
   mitre_attack_id:
+  - T1059
   - T1059.001
   nist:
   - PR.PT

detections/endpoint/monitor_registry_keys_for_print_monitors.yml

@@ -47,6 +47,7 @@ tags:
   message: New print monitor added on $dest$
   mitre_attack_id:
   - T1547.010
+  - T1547
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/ms_scripting_process_loading_ldap_module.yml

@@ -42,6 +42,7 @@ tags:
   - Exploitation
   message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$
   mitre_attack_id:
+  - T1059
   - T1059.007
   observable:
   - name: dest

detections/endpoint/ms_scripting_process_loading_wmi_module.yml

@@ -43,6 +43,7 @@ tags:
   - Exploitation
   message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$
   mitre_attack_id:
+  - T1059
   - T1059.007
   observable:
   - name: dest

detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml

@@ -42,6 +42,7 @@ tags:
   message: a mshta parent process $parent_process_name$ spawn child process $process_name$
     in host $dest$
   mitre_attack_id:
+  - T1218
   - T1218.005
   observable:
   - name: dest

detections/endpoint/mshtml_module_load_in_office_product.yml

@@ -41,6 +41,7 @@ tags:
   message: An instance of $process_name$ was identified on endpoint $dest$ loading
     mshtml.dll.
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/msmpeng_application_dll_side_loading.yml

@@ -34,6 +34,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1574.002
+  - T1574
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -59,6 +59,7 @@ tags:
   message: Potential Kerberos based password spraying attack from $Client_Address$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: Client_Address
     type: Endpoint

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -59,6 +59,7 @@ tags:
   message: Potential Kerberos based password spraying attack from $Client_Address$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: Client_Address
     type: Endpoint

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -63,6 +63,7 @@ tags:
   message: Potential NTLM based password spraying attack from $Source_Workstation$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: Source_Workstation
     type: Endpoint

detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml

@@ -64,6 +64,7 @@ tags:
   message: Potential password spraying attack from $ComputerName$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: ComputerName
     type: Endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -59,6 +59,7 @@ tags:
   message: Potential Kerberos based password spraying attack from $Client_Address$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: Client_Address
     type: Endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -61,6 +61,7 @@ tags:
   message: Potential NTLM based password spraying attack from $Source_Workstation$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: Source_Workstation
     type: Endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml

@@ -63,6 +63,7 @@ tags:
   message: Potential password spraying attack from $ComputerName$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: ComputerName
     type: Endpoint

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml

@@ -62,6 +62,7 @@ tags:
   message: Potential password spraying attack on $ComputerName$
   mitre_attack_id:
   - T1110.003
+  - T1110
   observable:
   - name: ComputerName
     type: Endpoint

detections/endpoint/net_localgroup_discovery.yml

@@ -41,6 +41,7 @@ tags:
   - Reconnaissance
   message: Local group discovery on $dest$ by $user$.
   mitre_attack_id:
+  - T1069
   - T1069.001
   observable:
   - name: dest

detections/endpoint/net_profiler_uac_bypass.yml

@@ -44,6 +44,7 @@ tags:
     path $registry_value_name$ in $dest$
   mitre_attack_id:
   - T1548.002
+  - T1548
   observable:
   - name: dest
     type: Hostname

detections/endpoint/nishang_powershelltcponeline.yml

@@ -46,6 +46,7 @@ tags:
   - Exploitation
   message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: dest

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -40,6 +40,7 @@ tags:
   - Exploitation
   message: a non firefox browser process $process_name$ accessing $Object_Name$
   mitre_attack_id:
+  - T1555
   - T1555.003
   observable:
   - name: dest

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -40,6 +40,7 @@ tags:
   - Exploitation
   message: a non firefox browser process $process_name$ accessing $Object_Name$
   mitre_attack_id:
+  - T1555
   - T1555.003
   observable:
   - name: dest

detections/endpoint/ntdsutil_export_ntds.yml

@@ -55,6 +55,7 @@ tags:
   message: Active Directory NTDS export on $dest$
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/office_application_drop_executable.yml

@@ -45,6 +45,7 @@ tags:
   - Exploitation
   message: process $process_name$ drops a file $TargetFilename$ in host $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: Computer

detections/endpoint/office_application_spawn_regsvr32_process.yml

@@ -41,6 +41,7 @@ tags:
   - Exploitation
   message: Office application spawning regsvr32.exe on $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -43,6 +43,7 @@ tags:
   - Exploitation
   message: Office application spawning rundll32.exe on $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_document_creating_schedule_task.yml

@@ -47,6 +47,7 @@ tags:
   - Exploitation
   message: Office document creating a schedule task on $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_document_executing_macro_code.yml

@@ -42,6 +42,7 @@ tags:
   - Exploitation
   message: Office document executing a macro on $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_document_spawned_child_process_to_download.yml

@@ -41,6 +41,7 @@ tags:
   - Exploitation
   message: Office document spawning suspicious child process on $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -43,6 +43,7 @@ tags:
   message: an office product parent process $parent_process_name$ spawn child process
     $process_name$ in host $dest$
   mitre_attack_id:
+  - T1218
   - T1218.005
   observable:
   - name: dest

detections/endpoint/office_product_spawning_bitsadmin.yml

@@ -48,6 +48,7 @@ tags:
   message: office parent process $parent_process_name$ will execute a suspicious child
     process $process_name$ with process id $process_id$ in host $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_product_spawning_certutil.yml

@@ -48,6 +48,7 @@ tags:
   message: office parent process $parent_process_name$ will execute a suspicious child
     process $process_name$ with process id $process_id$ in host $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_product_spawning_mshta.yml

@@ -48,6 +48,7 @@ tags:
   message: office parent process $parent_process_name$ will execute a suspicious child
     process $process_name$ with process id $process_id$ in host $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml

@@ -51,6 +51,7 @@ tags:
     process $process_name$ with process id $process_id$ and no dll commandline $process$
     in host $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_product_spawning_wmic.yml

@@ -50,6 +50,7 @@ tags:
   message: office parent process $parent_process_name$ will execute a suspicious child
     process $process_name$ with process id $process_id$ in host $dest$
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_product_writing_cab_or_inf.yml

@@ -49,6 +49,7 @@ tags:
   message: An instance of $process_name$ was identified on $dest$ writing an inf or
     cab file to this. This is not typical of $process_name$.
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/office_spawning_control.yml

@@ -50,6 +50,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ clicking a suspicious attachment.
   mitre_attack_id:
+  - T1566
   - T1566.001
   observable:
   - name: dest

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -43,6 +43,7 @@ tags:
   - Actions on Objectives
   message: A suspicious file modification or replace in $file_path$  in host $dest$
   mitre_attack_id:
+  - T1546
   - T1546.008
   nist:
   - PR.PT

detections/endpoint/powershell_4104_hunting.yml

@@ -61,6 +61,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ executing suspicious commands.
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: user

detections/endpoint/powershell_creating_thread_mutex.yml

@@ -41,6 +41,7 @@ tags:
   message: A suspicious powershell script contains Thread Mutex in $Message$ with
     EventCode $EventCode$ in host $ComputerName$
   mitre_attack_id:
+  - T1027
   - T1027.005
   observable:
   - name: ComputerName

detections/endpoint/powershell_disable_security_monitoring.yml

@@ -36,6 +36,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.001
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/powershell_domain_enumeration.yml

@@ -46,6 +46,7 @@ tags:
   message: A suspicious powershell script contains domain enumeration command in $Message$
     with EventCode $EventCode$ in host $ComputerName$
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: ComputerName

detections/endpoint/powershell_enable_smb1protocol_feature.yml

@@ -30,6 +30,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
+  - T1027
   - T1027.005
   product:
   - Splunk Enterprise

detections/endpoint/powershell_execute_com_object.yml

@@ -40,6 +40,7 @@ tags:
     with EventCode $EventCode$ in host $ComputerName$
   mitre_attack_id:
   - T1546.015
+  - T1546
   observable:
   - name: ComputerName
     type: Hostname

detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml

@@ -49,6 +49,7 @@ tags:
   message: A suspicious powershell script contains GetProcAddress API in $Message$
     with EventCode $EventCode$ in host $ComputerName$
   mitre_attack_id:
+  - T1059
   - T1055
   - T1059.001
   observable:

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -49,6 +49,7 @@ tags:
   message: A suspicious powershell script contains base64 command in $Message$ with
     EventCode $EventCode$ in host $ComputerName$
   mitre_attack_id:
+  - T1059
   - T1027
   - T1059.001
   observable:

detections/endpoint/powershell_get_localgroup_discovery.yml

@@ -40,6 +40,7 @@ tags:
   - Reconnaissance
   message: Local group discovery on $dest$ by $user$.
   mitre_attack_id:
+  - T1069
   - T1069.001
   observable:
   - name: dest

detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml

@@ -49,6 +49,7 @@ tags:
   - Reconnaissance
   message: Local group discovery on $dest$ by $user$.
   mitre_attack_id:
+  - T1069
   - T1069.001
   observable:
   - name: dest

detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml

@@ -50,6 +50,7 @@ tags:
   message: A suspicious powershell script contains reflective class assembly  command
     in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: ComputerName

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -42,6 +42,7 @@ tags:
     for processing compressed or to decompressed binary file with EventCode $EventCode$
     in host $ComputerName$
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: ComputerName

detections/endpoint/print_spooler_adding_a_printer_driver.yml

@@ -50,6 +50,7 @@ tags:
   message: Suspicious print driver was loaded on endpoint $ComputerName$.
   mitre_attack_id:
   - T1547.012
+  - T1547
   observable:
   - name: ComputerName
     type: Endpoint

detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml

@@ -48,6 +48,7 @@ tags:
     with EventCode $EventCode$.
   mitre_attack_id:
   - T1547.012
+  - T1547
   observable:
   - name: ComputerName
     type: Hostname

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -51,6 +51,7 @@ tags:
   message: A process $process_name$ that launching .lnk file in $file_path$ in host
     $dest$
   mitre_attack_id:
+  - T1566
   - T1566.002
   nist:
   - ID.AM

detections/endpoint/process_kill_base_on_file_path.yml

@@ -41,6 +41,7 @@ tags:
     commandline $process$ in host $dest$
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: dest
     type: Hostname

detections/endpoint/processes_launching_netsh.yml

@@ -49,6 +49,7 @@ tags:
     in host $dest$
   mitre_attack_id:
   - T1562.004
+  - T1562
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml

@@ -35,6 +35,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1070.004
+  - T1070
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml

@@ -49,6 +49,7 @@ tags:
   message: A reg.exe process $process_name$ with commandline $process$ in host $dest$
   mitre_attack_id:
   - T1574.011
+  - T1574
   nist:
   - PR.IP
   - PR.PT

detections/endpoint/registry_keys_for_creating_shim_databases.yml

@@ -42,6 +42,7 @@ tags:
     $dest$
   mitre_attack_id:
   - T1546.011
+  - T1546
   nist:
   - PR.PT
   - DE.CM