diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index 21636a70dc..c234f36c5e 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -49,6 +49,7 @@ tags: - Reconnaissance message: System group discovery enumeration on $dest$ by $user$. mitre_attack_id: + - T1069 - T1069.001 observable: - name: dest diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index cef640c54c..db1c10b8d6 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -40,6 +40,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 020781ea8e..203d37d465 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -38,6 +38,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 2a7a65ac3b..9ac798505f 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -40,6 +40,7 @@ tags: - Reconnaissance message: Domain group discovery with PowerView on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 5581a5dc9b..fdc3b7c0e9 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -39,6 +39,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration using PowerView on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 1024798cce..020615cadd 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -38,6 +38,7 @@ tags: - Reconnaissance message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1087 - T1087.001 observable: - name: dest diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index a0c17849da..22774af191 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -36,6 +36,7 @@ tags: - Reconnaissance message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1087 - T1087.001 observable: - name: dest diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index b54f8f381f..eaa34c8215 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -42,6 +42,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index 09c1977e6a..913a3c5b12 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -39,6 +39,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 9ba8d47259..26e14b6cd0 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -43,6 +43,7 @@ tags: message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1087.002 + - T1087 observable: - name: user type: User diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index 39ee2767ac..3ba1b7dae8 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -38,6 +38,7 @@ tags: message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: - T1087.002 + - T1087 observable: - name: ComputerName type: Hostname diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index a7947ad2e7..f8d752fb4a 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -39,6 +39,7 @@ tags: - Reconnaissance message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1087 - T1087.001 observable: - name: dest diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index 72133c07e3..e56990abe9 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -36,6 +36,7 @@ tags: - Reconnaissance message: Local user discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1087 - T1087.001 observable: - name: dest diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 1e09f29522..a25bd2c490 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -45,6 +45,7 @@ tags: by $user$ mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 3a1fc7c969..ba70ca1892 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -43,6 +43,7 @@ tags: - Actions on Objectives message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. mitre_attack_id: + - T1222 - T1222.001 nist: - DE.CM diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index d15cc3af5f..06a6670bcf 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -36,6 +36,7 @@ tags: message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ mitre_attack_id: - T1560.001 + - T1560 observable: - name: Computer type: Hostname diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 283084eb7a..af8f30ae12 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -42,6 +42,7 @@ tags: message: Process name $process_name$ with commandline $process$ to execute jscript in $dest$ mitre_attack_id: + - T1059 - T1059.007 observable: - name: dest diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 7615864c22..16e0546134 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -39,6 +39,7 @@ tags: on $dest$ mitre_attack_id: - T1558.003 + - T1558 nist: - DE.CM observable: diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index e59d230302..d2220dfca8 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -37,6 +37,7 @@ tags: - Reconnaissance message: Local user discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1087 - T1087.001 observable: - name: dest diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index 299aada6a3..d2dd2876a8 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -36,6 +36,7 @@ tags: - Reconnaissance message: Local user discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1087 - T1087.001 observable: - name: dest diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index e881970354..988c8c82cf 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -33,6 +33,7 @@ tags: kill_chain_phases: - Exploitation mitre_attack_id: + - T1037 - T1037.001 product: - Splunk Enterprise diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index ab322fb2f1..028bb99c8b 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -38,6 +38,7 @@ tags: message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. mitre_attack_id: + - T1114 - T1114.001 observable: - name: dest diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index fb6382ba34..391afadbf2 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -39,6 +39,7 @@ tags: message: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ mitre_attack_id: + - T1569 - T1569.002 observable: - name: dest diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 092198c93f..f984d5eae3 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -49,6 +49,7 @@ tags: - Actions on Objectives message: PowerShell local execution policy bypass attempt on $dest$ mitre_attack_id: + - T1059 - T1059.001 nist: - PR.PT diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 69aff6f30b..dd40105004 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -47,6 +47,7 @@ tags: - Actions on Objectives message: Powershell.exe running with potential obfuscated arguments on $dest$ mitre_attack_id: + - T1059 - T1059.001 nist: - PR.PT diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index a5f4f5809b..ce986c1257 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -47,6 +47,7 @@ tags: message: New print monitor added on $dest$ mitre_attack_id: - T1547.010 + - T1547 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index d918a16e6c..39ae4926de 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -42,6 +42,7 @@ tags: - Exploitation message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$ mitre_attack_id: + - T1059 - T1059.007 observable: - name: dest diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 50a0e0d6e3..369b9ee11e 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -43,6 +43,7 @@ tags: - Exploitation message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$ mitre_attack_id: + - T1059 - T1059.007 observable: - name: dest diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index c03f56b0ac..9dce88003b 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -42,6 +42,7 @@ tags: message: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ mitre_attack_id: + - T1218 - T1218.005 observable: - name: dest diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index e644c3940b..3f69b6ceb5 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -41,6 +41,7 @@ tags: message: An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 5949d345bf..c172950f46 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -34,6 +34,7 @@ tags: - Exploitation mitre_attack_id: - T1574.002 + - T1574 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index af9c0c7a6a..415b3d1c90 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -59,6 +59,7 @@ tags: message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: Client_Address type: Endpoint diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index f7c63392df..963bf4798f 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -59,6 +59,7 @@ tags: message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: Client_Address type: Endpoint diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index 921b06b0d4..151c4529bf 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -63,6 +63,7 @@ tags: message: Potential NTLM based password spraying attack from $Source_Workstation$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: Source_Workstation type: Endpoint diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index 6c7ec500e2..5e26a71bed 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -64,6 +64,7 @@ tags: message: Potential password spraying attack from $ComputerName$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: ComputerName type: Endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 993b23b81e..37598d8b2d 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -59,6 +59,7 @@ tags: message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: Client_Address type: Endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index 0a0836c811..845ed682fa 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -61,6 +61,7 @@ tags: message: Potential NTLM based password spraying attack from $Source_Workstation$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: Source_Workstation type: Endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index 9ba84c5279..d03cfac314 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -63,6 +63,7 @@ tags: message: Potential password spraying attack from $ComputerName$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: ComputerName type: Endpoint diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 8771fb2160..b9d616aeaf 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -62,6 +62,7 @@ tags: message: Potential password spraying attack on $ComputerName$ mitre_attack_id: - T1110.003 + - T1110 observable: - name: ComputerName type: Endpoint diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index 768e1b7b54..be87f8b84f 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -41,6 +41,7 @@ tags: - Reconnaissance message: Local group discovery on $dest$ by $user$. mitre_attack_id: + - T1069 - T1069.001 observable: - name: dest diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index f13ad3cef2..1bbe6e2656 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -44,6 +44,7 @@ tags: path $registry_value_name$ in $dest$ mitre_attack_id: - T1548.002 + - T1548 observable: - name: dest type: Hostname diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index e43528e550..5c14627938 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -46,6 +46,7 @@ tags: - Exploitation message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ mitre_attack_id: + - T1059 - T1059.001 observable: - name: dest diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index dafea93521..a6855f1329 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -40,6 +40,7 @@ tags: - Exploitation message: a non firefox browser process $process_name$ accessing $Object_Name$ mitre_attack_id: + - T1555 - T1555.003 observable: - name: dest diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 042ef2a34f..2b169b61ad 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -40,6 +40,7 @@ tags: - Exploitation message: a non firefox browser process $process_name$ accessing $Object_Name$ mitre_attack_id: + - T1555 - T1555.003 observable: - name: dest diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 12b840d0ea..0b7c18eac7 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -55,6 +55,7 @@ tags: message: Active Directory NTDS export on $dest$ mitre_attack_id: - T1003.003 + - T1003 nist: - DE.CM observable: diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 02b1eaa4f3..3d970d16e8 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -45,6 +45,7 @@ tags: - Exploitation message: process $process_name$ drops a file $TargetFilename$ in host $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: Computer diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 68bbcc546b..8b21933453 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -41,6 +41,7 @@ tags: - Exploitation message: Office application spawning regsvr32.exe on $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index cad9a40af1..28228cc7b7 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -43,6 +43,7 @@ tags: - Exploitation message: Office application spawning rundll32.exe on $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 4d479975a8..e3455839fd 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -47,6 +47,7 @@ tags: - Exploitation message: Office document creating a schedule task on $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 198925b8da..5d78357f23 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -42,6 +42,7 @@ tags: - Exploitation message: Office document executing a macro on $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 3c20bc426a..79eac14dc6 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -41,6 +41,7 @@ tags: - Exploitation message: Office document spawning suspicious child process on $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index adaf7de575..5745a10a4a 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -43,6 +43,7 @@ tags: message: an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ mitre_attack_id: + - T1218 - T1218.005 observable: - name: dest diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index cdb600e6e5..dd2294d824 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -48,6 +48,7 @@ tags: message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index f7cf768231..0e0d0e94fe 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -48,6 +48,7 @@ tags: message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 6106b3e695..d838666728 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -48,6 +48,7 @@ tags: message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index cfbeb7c686..e2dfd12596 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -51,6 +51,7 @@ tags: process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index fa41770c29..efd315eb71 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -50,6 +50,7 @@ tags: message: office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index db49bd8fd4..9716d778fc 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -49,6 +49,7 @@ tags: message: An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index 446ff63f48..c1a024ed2b 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -50,6 +50,7 @@ tags: message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment. mitre_attack_id: + - T1566 - T1566.001 observable: - name: dest diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index f15b0a9895..a61cab427c 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -43,6 +43,7 @@ tags: - Actions on Objectives message: A suspicious file modification or replace in $file_path$ in host $dest$ mitre_attack_id: + - T1546 - T1546.008 nist: - PR.PT diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 01dd1b41b7..ee4bb6d61a 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -61,6 +61,7 @@ tags: message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing suspicious commands. mitre_attack_id: + - T1059 - T1059.001 observable: - name: user diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 3b4c93be23..0602742c85 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -41,6 +41,7 @@ tags: message: A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: + - T1027 - T1027.005 observable: - name: ComputerName diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 94dde9352f..407a386845 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -36,6 +36,7 @@ tags: - Exploitation mitre_attack_id: - T1562.001 + - T1562 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index 8fa2e478d1..4021aed5c3 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -46,6 +46,7 @@ tags: message: A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: + - T1059 - T1059.001 observable: - name: ComputerName diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index d1957dc29e..e75d2001d3 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -30,6 +30,7 @@ tags: kill_chain_phases: - Exploitation mitre_attack_id: + - T1027 - T1027.005 product: - Splunk Enterprise diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index bc3b89bde8..30626cd311 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -40,6 +40,7 @@ tags: with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: - T1546.015 + - T1546 observable: - name: ComputerName type: Hostname diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 040219fbfd..714cc5862c 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -49,6 +49,7 @@ tags: message: A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: + - T1059 - T1055 - T1059.001 observable: diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index e903014977..9ebd2144a7 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -49,6 +49,7 @@ tags: message: A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: + - T1059 - T1027 - T1059.001 observable: diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 09ac3e7d86..85979673ad 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -40,6 +40,7 @@ tags: - Reconnaissance message: Local group discovery on $dest$ by $user$. mitre_attack_id: + - T1069 - T1069.001 observable: - name: dest diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 449c4c4ce0..1faf799219 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -49,6 +49,7 @@ tags: - Reconnaissance message: Local group discovery on $dest$ by $user$. mitre_attack_id: + - T1069 - T1069.001 observable: - name: dest diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index ee9ee03b06..09c32ff942 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -50,6 +50,7 @@ tags: message: A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: + - T1059 - T1059.001 observable: - name: ComputerName diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index c0a533d2d5..cb00089ad5 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -42,6 +42,7 @@ tags: for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ mitre_attack_id: + - T1059 - T1059.001 observable: - name: ComputerName diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index cc1cfc97e3..d65fc252fd 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -50,6 +50,7 @@ tags: message: Suspicious print driver was loaded on endpoint $ComputerName$. mitre_attack_id: - T1547.012 + - T1547 observable: - name: ComputerName type: Endpoint diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 6e5b4fc245..919bc479cc 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -48,6 +48,7 @@ tags: with EventCode $EventCode$. mitre_attack_id: - T1547.012 + - T1547 observable: - name: ComputerName type: Hostname diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 9489d60655..debc480234 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -51,6 +51,7 @@ tags: message: A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ mitre_attack_id: + - T1566 - T1566.002 nist: - ID.AM diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 348aa36b7c..1f31e2837d 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -41,6 +41,7 @@ tags: commandline $process$ in host $dest$ mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Hostname diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 9d38fe10ac..faf4444a75 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -49,6 +49,7 @@ tags: in host $dest$ mitre_attack_id: - T1562.004 + - T1562 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index c6ff3b9dc0..9d4d46991d 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -35,6 +35,7 @@ tags: - Exploitation mitre_attack_id: - T1070.004 + - T1070 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 976e65c665..ffd507fbab 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -49,6 +49,7 @@ tags: message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ mitre_attack_id: - T1574.011 + - T1574 nist: - PR.IP - PR.PT diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 12583e6efe..5d87f2c5a4 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -42,6 +42,7 @@ tags: $dest$ mitre_attack_id: - T1546.011 + - T1546 nist: - PR.PT - DE.CM